# New Search Feature: Search for non-public words in limited disclosure reports

HackerOne beta search matched keywords against full limited-disclosure reports, letting attackers brute-force secret strings hidden in the non-public portion.

- Payout: hidden
- Severity: medium
- Program: HackerOne
- Found by: ahacker1
- Disclosed: 2023-10-25
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/2213251
- Library page: https://bugbountylibrary.com/r/h1%3A2213251
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:medium technique:blind technique:recon vuln:idor vuln:info-disclosure

**Target:** hackerone.com beta report search feature
**Root cause:** The search index matched query terms against the entire report body including the non-public portion, but results were shown on limited-disclosure reports, revealing existence of hidden words.
**Steps:**
1. Enable the beta search feature.
2. Search `addProjectV2ItemById AND reporter:("ahacker1")`.
3. Observe a hit on limited-disclosure report 1711938 even though the phrase is absent from the public portion.
4. Iterate prefix guesses (`PREFIX_a`, `PREFIX_b`, ...) to brute-force a secret character by character.
**How found:** Researcher noticed the new beta search returned hits for phrases not present in the limited-disclosure portion of a report, hypothesizing the index covered the full report body.
**Exploitation:** Attacker submits search queries scoped to a target reporter and observes whether a guessed prefix matches, using the boolean hit as an oracle to reconstruct hidden secret strings character by character (~1200 tries for a 40-char secret).
**Insight:** When a search feature is added over content with partial-visibility rules, test whether the index respects the same visibility boundary as the rendered page; a boolean match/no-match on hidden fields becomes a character-by-character oracle.