HackerOne Disclosed Reports - 2025-04-01

Critical
resolved

The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is present

Bug reported by Avinash Kumar was disclosed at April 1, 2025, 6:23 pm   |   Information Disclosure

The /reports/:id.json endpoint disclosed potentially sensitive user attributes, including the reporter's email, OTP backup codes, phone number, graphql_secret_token, and t-shirt size when a reporter summary was present.