# Discrepancy in hacker profile report count may reveal existence of a private program by publishing a report

GraphQL createExternalReport mutation allowed submitting reports to any external handle; profile 'Bugs found' count incremented only for real programs, revealing private/sandbox programs.

- Payout: $3,000
- Severity: medium
- Program: HackerOne
- Credited: haxta4ok00
- Disclosed: 2019-04-24
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/410015
- Library page: https://bugbountylibrary.com/r/h1%3A410015
- Tags: domain:web impact:data-leak kind:bounty platform:hackerone sev:medium tech:graphql technique:incomplete-fix technique:recon vuln:access-control vuln:info-disclosure

**Target:** HackerOne hackerone.com GraphQL createExternalReport mutation and hacker profile report count
**Root cause:** The createExternalReport GraphQL mutation accepted arbitrary external program handles without validating whether the program was public, and the profile 'Bugs found' counter incremented for reports created against real (including private) programs but not sandbox programs, creating an observable side channel.
**Steps:**
1. Send the `createExternalReport` GraphQL mutation with `input_0.handle` set to a target external handle and minimal title/vulnerability_information fields
2. Note the profile 'Bugs found' count before the request
3. Submit the mutation for the candidate handle
4. Reload the attacker profile page and compare 'Bugs found' count
5. If count incremented, the handle corresponds to a real (possibly private) program; if unchanged, it is a sandbox/nonexistent program
6. Repeat across candidate handles (@cisco, @apache, etc.) to enumerate private programs
**How found:** Prior report #401476 established the publish-report query; researcher noticed the profile count did not account for sandbox reports and hypothesized the counter could act as an oracle for program existence, then tested against known public (@cisco, @apache) and unknown handles.
**Exploitation:** Attacker submits reports via the GraphQL mutation to arbitrary external handles and observes whether their own profile report count increments, using the discrepancy to distinguish private programs from sandboxes and enumerate hidden programs.
**Insight:** When a mutation accepts arbitrary identifiers, look for side effects (counters, notifications, profile stats) that differ between valid-but-hidden and invalid targets; such oracles leak existence of private resources even without direct read access.