HackerOne: Private Program all members disclosed

2017-10-26T18:06:40
ID H1:283309
Type hackerone
Reporter vulnh0lic
Modified 2017-11-16T13:27:28

Description

After receiving an invite to a private program, it was possible to view all of its team members:

https://hackerone.com/invitations/{invitation code}.json

"team_members":[{"username":"<censored>"},{"username":"<censored>"},{"username":"<censored>"},{"username":"<censored>"},{"username":"<censored>"},{"username":"<censored>"}]}}