# GPS metadata preserved when converting HEIF to PNG

Reddit's HEIC-to-PNG conversion preserved GPS EXIF metadata, publicly exposing uploaders' home locations via i.redd.it image URLs.

- Payout: hidden
- Severity: high
- Program: Reddit
- Found by: ianonavy
- Disclosed: 2021-10-21
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1069039
- Library page: https://bugbountylibrary.com/r/h1%3A1069039
- Tags: area:web domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:high tech:payment technique:recon vuln:info-disclosure

**Target:** Image upload/conversion pipeline (i.redd.it PNG output)
**Root cause:** The HEIC/HEIF-to-PNG conversion path fails to strip EXIF GPS metadata, unlike other upload paths which scrub it correctly.
**Steps:**
1. Take a GPS-tagged Live Photo on iPhone 11 Pro
2. Sync to iCloud Photos
3. Upload HEIC file to reddit.com via Safari on macOS Big Sur
4. Submit post to any community
5. Open the i.redd.it/FILENAME.png link and download
6. Inspect EXIF: GPS coordinates still present
**How found:** Researcher spot-checked an image they had uploaded themselves and noticed GPS metadata survived conversion; then tested multiple browser/device flows to map which paths preserved metadata and found another user's image in the wild with GPS intact.
**Exploitation:** Attacker scrapes public i.redd.it PNG URLs derived from HEIC uploads and extracts embedded GPS EXIF to geolocate users, with no authorization and little detection.
**Insight:** Metadata scrubbing is often implemented per-format or per-conversion-path; test each accepted input format (HEIC, TIFF, etc.) and each browser upload path separately, since one converter branch may skip the EXIF strip that others perform.