# The Time I Hacked Google’s Manual Actions Database

Google's manual actions viewer API accepted any domain without authorization checks, exposing the full penalties database for any site.

- Payout: $5,000
- Severity: high
- Program: Google
- Found by: Tom Anthony (@TomAnthonySEO)
- Disclosed: 2023-03-13
- Write-up quality: 6/10
- Original: https://www.tomanthony.co.uk/blog/googles-manual-actions-hack/
- Library page: https://bugbountylibrary.com/r/blog%3Atomanthony-co-uk-blog-googles-manual-actions-hack
- Tags: area:web domain:api domain:web impact:data-leak kind:bounty platform:blog sev:high tech:rest vuln:access-control vuln:idor vuln:info-disclosure

**Target:** Manual actions viewer API endpoint
**Root cause:** The API endpoint that returned manual action reports took a domain parameter and performed no authorization check that the caller owned or had access to that domain.
**Steps:**
1. Inspect the API request behind the manual actions viewer; note the domain parameter in the payload.
2. Replay the request with the domain parameter changed to a domain not owned by the tester.
3. Observe the response returns that domain's manual action penalties, confirming no authorization check.
**How found:** After confirming the tool didn't leak extra penalty info, the researcher sanity-checked whether he could access reports for sites he shouldn't have access to by tampering with the domain parameter.
**Exploitation:** Any authenticated user could substitute an arbitrary domain in the API request and retrieve the manual actions/penalties associated with it, giving access to the full manual actions database.
**Insight:** When a new Google tool exposes per-site data, test whether the domain/site identifier in the API request is authorized server-side rather than trusted from the client.