# People who interviewed for HackerOne security analyst position can be enumerated and their personal email address may be exposed

Interview candidates for HackerOne's triage role could enumerate prior candidates and expose their non-HackerOne personal emails via leftover sample reports in the h1triage program.

- Payout: $500
- Severity: low
- Program: HackerOne
- Credited: testdefense
- Disclosed: 2018-06-25
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/353310
- Library page: https://bugbountylibrary.com/r/h1%3A353310
- Tags: domain:web impact:internal-access impact:pii-leak kind:bounty platform:hackerone sev:low tech:rest vuln:access-control vuln:info-disclosure

**Target:** h1triage interview program (bugs.json and report JSON endpoints)
**Root cause:** Old sample/interview reports and group member data were never purged from the h1triage program, so any new candidate granted access could read prior candidates' answers and personal email addresses.
**Steps:**
1. Sign in as a member of the h1triage team (mock triage interview)
2. Browse to `https://hackerone.com/h1triage/groups/25396/members/edit` to view member emails
3. Enumerate reports: `curl --cookie '<COOKIE>' 'https://hackerone.com/bugs.json?subject=h1triage&...&limit=1000'` and extract `id` fields
4. For each id, `curl --cookie '<COOKIE>' 'https://hackerone.com/reports/$id.json'` and grep `username` to build candidate list
5. Cross-reference profiles to see who became HackerOne triagers
**How found:** While given access to the h1triage program as an interview candidate, the researcher noticed prior candidates' answers and personal emails were still visible, then scripted enumeration of the report list and per-report JSON.
**Exploitation:** A candidate with legitimate h1triage access used the program's bugs.json listing and per-report JSON endpoints to enumerate all 130 interview reports, extracting candidate usernames and non-HackerOne emails for social engineering.
**Insight:** When granted temporary access to an interview/onboarding tenant, enumerate its report/group listings for leftover data from previous cohorts — stale sample reports often retain PII of prior candidates.