Summary: When private program updates the handle of the hackerone program, former team members can see the new updated handles using old invitation link.
The invitation link looks like
This may also be true for participants participating in private programs but i can not confirm this yet.
Description (Include Impact):
Former team members should not see the updated handle. Lets consider the example of
█████ private program which may have invited few team members and later removed them for some reason. The program was later acquired by
█████████ and handle was changed accordingly. But the former team members can still see this updated name as
██████████ using old invitation links. I verified this by changing my demo team handle from test account using hackerone support.
This may be possible for researchers too. when private program invites them, they also get invitation links. if researcher themselves quits the program or program decides to remove them for some reason, they can still use old invitation link which redirects to new updated handle.