# HackerOne customer submitted sensitive link to VirusTotal, exposing confidential information

A report invitation_token leaked in a VirusTotal domain scan, letting anyone accept it and gain manage access to a private HackerOne report.

- Payout: hidden
- Severity: none
- Program: HackerOne
- Found by: user_name2023
- Disclosed: 2018-07-26
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/378122
- Library page: https://bugbountylibrary.com/r/h1%3A378122
- Tags: area:web domain:web impact:integrity impact:internal-access kind:bounty platform:hackerone technique:recon vuln:access-control vuln:info-disclosure vuln:secrets-leak

**Target:** Report invitation link / invitation_token endpoint
**Root cause:** A confidential report invitation URL containing an invitation_token was submitted to VirusTotal, which publicly indexed and displayed it in the domain's URL list; the token alone authorized accepting the invitation.
**Steps:**
1. Open `https://www.virustotal.com/#/domain/hackerone.com`
2. Scroll to the end of the page to the URL list
3. Find the leaked URL `https://hackerone.com/reports/334677?invitation_token=███████`
4. Open the URL and observe the invitation acceptance page
5. Click accept to be added as a manager of the report
**How found:** Researcher browsed VirusTotal's public URL listing for hackerone.com and noticed a report URL with an invitation_token parameter, then tested whether the token still worked.
**Exploitation:** Anyone viewing the public VirusTotal domain page could copy the invitation_token URL, open it, and click accept to become a manager of the private report without any other authentication check beyond the token.
**Escalation:** Manager access allowed closing/resolving the report, public disclosure, posting comments as the program, and reading internal staff comments.
**Insight:** Third-party scanners and URL-indexing services (VirusTotal, URLScan, archive sites) can republish secret-bearing URLs; enumerate your domain's public scan history for tokens/keys in query strings.