# The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is present

HackerOne's /reports/:id.json endpoint returned reporter's email, phone, OTP backup codes, and GraphQL secret token to unauthenticated viewers.

- Payout: hidden
- Severity: critical
- Program: HackerOne
- Found by: avinash_
- Disclosed: 2025-04-01
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/3000510
- Library page: https://bugbountylibrary.com/r/h1%3A3000510
- Tags: area:web domain:web impact:ato impact:pii-leak kind:bounty platform:hackerone sev:critical tech:rest technique:recon vuln:info-disclosure vuln:secrets-leak

**Target:** www.hackerone.com /reports/:id.json endpoint
**Root cause:** The JSON representation of disclosed reports serialized the full reporter user object instead of a sanitized subset, exposing private account attributes.
**Steps:**
1. Browse a disclosed report page and note the report id
2. Request `GET /reports/<id>.json HTTP/2` with `Host: hackerone.com`
3. Observe response containing reporter email, phone, OTP backup codes, graphql_secret_token, tshirt size, and other internal account fields
**How found:** While viewing a disclosed report, the researcher checked the .json variant of the same URL and noticed excessive reporter data in the response.
**Exploitation:** Unauthenticated GET of the .json endpoint for any disclosed report returned the reporter's private account data, including OTP backup codes and a GraphQL secret token, enabling account takeover of reporters.
**Escalation:** OTP backup codes plus graphql_secret_token could allow bypassing MFA and impersonating the reporter account.
**Insight:** Disclosed report pages often have parallel JSON/API representations that bypass the view-layer redaction; always request the .json/API variant of a public page and diff fields against what the HTML shows.