# Internal attachments can be exported via "Export as .zip" feature

HackerOne's Export-as-zip feature included internal attachments that had been removed from a disclosed report, letting any user download team-only files.

- Payout: $12,500
- Severity: high
- Program: HackerOne
- Credited: japz
- Disclosed: 2016-11-30
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/186230
- Library page: https://bugbountylibrary.com/r/h1%3A186230
- Tags: domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:high technique:incomplete-fix technique:regression vuln:access-control vuln:info-disclosure

**Target:** Report export (.zip) feature on hackerone.com
**Root cause:** The zip export bundled all report attachments including internal/removed ones, without filtering by viewer visibility or removal status.
**Steps:**
1. Open `https://hackerone.com/reports/182358`
2. Use 'Export as .zip' to download `HackerOne_Report-security#182358.zip`
3. Extract the archive
4. Observe the internal attachment that was removed from the disclosed thread is still present and viewable
**How found:** Researcher noticed a prior disclosed report (#182358) about the same export feature was only partially fixed, then re-tested the export flow on that report and found the removed attachment still in the zip.
**Exploitation:** Any user exports a disclosed report as zip and extracts internal attachments that were removed from the public thread, disclosing team-only content.
**Escalation:** Team RCA also found inline attachments could be guessed by identifier to view internal attachments later.
**Insight:** When a fix is disclosed, re-run the exact original PoC against the same object; partial fixes often leave the removed/private artifact still reachable through the same export or download path.