# Scope information is leaked when visiting policy scopes tab of any External Program

Unauthenticated GraphQL PolicyScopeAssetGroupsQuery on /policy_scopes leaked private program names and scopes, and oversized requests caused DoS.

- Payout: hidden
- Severity: medium
- Program: HackerOne
- Found by: buraaqsec
- Disclosed: 2023-03-10
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1868473
- Library page: https://bugbountylibrary.com/r/h1%3A1868473
- Tags: area:web3 domain:web impact:data-leak impact:dos kind:bounty platform:hackerone sev:medium tech:graphql technique:param-pollution vuln:access-control vuln:dos vuln:idor vuln:info-disclosure

**Target:** hackerone.com /policy_scopes GraphQL endpoint (PolicyScopeAssetGroupsQuery)
**Root cause:** The policy_scopes GraphQL query lacked authorization checks, returning scope asset groups for all programs including private/invite-only ones to unauthenticated users.
**Steps:**
1. Visit `https://hackerone.com/<program>/policy_scopes` unauthenticated
2. In Burp, find request with `operationName=PolicyScopeAssetGroupsQuery`, send to Repeater
3. Increase size parameter to 2215 (larger returns no results)
4. Search response for private program domains like `███.com`, `████.io`
**How found:** Researcher noticed the new scope policy feature at /policy_scopes and that appending it to a program URL broke the app, then inspected the GraphQL request in Burp and manipulated the size parameter to dump all scopes.
**Exploitation:** Unauthenticated attacker sends the PolicyScopeAssetGroupsQuery with a large size value and reads back private program names and scope domains from the response; oversized requests also broke hackerone.com loading (DoS).
**Escalation:** Increasing the size parameter enumerates all programs with the new scope policy, including private ones, and triggers DoS at large sizes.
**Insight:** Newly shipped GraphQL features often expose a query that resolves data across all tenants; append the feature path to any object URL and inspect the operationName to find missing authorization on the resolver.