# Public GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports information

HackerOne triage team's public GitHub repos leaked PoC scripts and secrets from 9 private managed bug bounty reports.

- Payout: hidden
- Severity: medium
- Program: HackerOne
- Found by: w2w
- Disclosed: 2025-05-31
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2937622
- Library page: https://bugbountylibrary.com/r/h1%3A2937622
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:medium tech:github-actions technique:recon technique:source-review vuln:info-disclosure vuln:secrets-leak

**Target:** Public GitHub/GitLab profiles of HackerOne-managed triage teams
**Root cause:** Triage teams pushed reproduction scripts and PoCs for private reports into public GitHub repositories under predictable usernames, never deleting or privatizing them after testing.
**Steps:**
1. Enumerate GitHub profiles of HackerOne-managed triage teams (predictable usernames)
2. List public repos and recent commits
3. Read PoC files e.g. `tester/blob/main/a.js` (IDOR exploit), `pom.xml` code-exec config, `.github/workflows/pr-build.yml` injection, `package.json` preinstall script
4. Correlate leaked scripts/secrets with private program targets
5. Bruteforce further individual triage profiles
**How found:** Noticed a shared GitHub profile for a managed triage team with 44 recently created public repos; hypothesized they were used to reproduce private-program vulns, then inspected recent repos and commits (including 'Retest' commits) to confirm.
**Exploitation:** No attack; researcher read public repos to recover PoCs, tokens, server URLs and secrets belonging to private reports.
**Insight:** Triage/security-team GitHub orgs with predictable names and many fresh public repos are a recon goldmine: check recent commits and 'Retest' branches for PoCs and secrets tied to private programs.