# Partial disclosure of report activity through new "Export as .zip" feature

New 'Export as .zip' feature on HackerOne leaked comments from limited-disclosure reports that should have been hidden, exposing restricted timeline activity.

- Payout: $10,000
- Severity: high
- Program: HackerOne
- Credited: faisalahmed
- Disclosed: 2016-11-29
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/182358
- Library page: https://bugbountylibrary.com/r/h1%3A182358
- Tags: domain:web impact:data-leak kind:bounty platform:hackerone sev:high technique:regression vuln:access-control vuln:info-disclosure

**Target:** Report export feature (zip export endpoint)
**Root cause:** The export functionality did not apply the same limited-disclosure visibility rules to comments that the report view enforced, so comments hidden in limited disclosure were included in the exported zip.
**Steps:**
1. Open a partially/limited-disclosed report at `https://hackerone.com/reports/<id>`
2. Click the **Export** button to download the .zip
3. Inspect the exported contents: comments that should be hidden under limited disclosure are present
**How found:** Noticed a newly launched export feature and tested it against a partially disclosed report, suspecting the new code path might not honor existing disclosure visibility rules.
**Exploitation:** Any user could export a limited-disclosure report and read comments that the disclosure policy intended to hide, revealing restricted timeline activity for affected programs.
**Insight:** When a platform ships a new export/download feature, test it against objects with restricted visibility (limited disclosure, redacted, internal-only) — new code paths often bypass the access rules enforced by the primary UI.