# Harvesting all private invites using leave program fast-tracked invitation and security@ email forwarding feature

Leaving a private program after a security@-forwarded invite triggered a fast-tracked re-invite, letting a researcher farm unlimited private program invitations.

- Payout: $2,500
- Severity: medium
- Program: HackerOne
- Credited: japz
- Disclosed: 2018-04-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/334205
- Library page: https://bugbountylibrary.com/r/h1%3A334205
- Tags: domain:web impact:internal-access kind:bounty platform:hackerone sev:medium tech:email technique:chained vuln:business-logic

**Target:** HackerOne platform invite/leave-program workflow
**Root cause:** The leave-program survey fast-tracked a new invitation regardless of how the participant joined, so leaving after a security@-forwarded invite yielded a fresh invite, creating a repeatable invite-generation loop.
**Steps:**
1. Find a program with security@ email forwarding enabled (send test email to declared security@ address; a submit-your-bug reply confirms it).
2. Send email to that security@ address to receive an invitation via forwarding.
3. Click Submit Vulnerability to become a participant.
4. Leave the program and complete the leave survey, confirm leave.
5. Receive fast-tracked invitation within ~24h.
6. Repeat steps 2-5 to accumulate invites.
**How found:** Noticed that the new Leave Program feature fast-tracks invitations and that security@ forwarding auto-generates invites, then combined the two flows to see if leaving regenerated an invite.
**Exploitation:** Attacker repeatedly emails a security@-forwarding program, accepts the forwarded invite, leaves via the leave-program flow to trigger a fast-tracked re-invite, and loops to harvest 100+ private invitations over months with no user interaction.
**Insight:** When a platform adds a 'fast-track re-invite' incentive on leaving, test it against every other invite-entry path (email forwarding, auto-invites) to see if the reward can be looped independent of the original qualification.