# Searching from Hacktivity returns hits for words in limited disclosure reports that are not visible

Hacktivity search leaked words from redacted report titles because a stale search vector was never updated after a title edit.

- Payout: hidden
- Severity: medium
- Program: HackerOne
- Found by: nathand
- Disclosed: 2019-11-08
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/685909
- Library page: https://bugbountylibrary.com/r/h1%3A685909
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:medium tech:ruby technique:recon technique:source-review vuln:info-disclosure

**Target:** Hacktivity search / report search vector
**Root cause:** Search vectors were refreshed via an after_commit hook keyed on previous_changes, but a second save! inside a nested transaction cleared previous_changes, so the vector update job never ran and stale title words stayed searchable.
**Steps:**
1. Go to the Hacktivity page.
2. Search `xss against application attack dangerous detect convince deliver direct mail mechanism occur publicly reference remove request responsible scheme script security supply themselves under victim vulnerable`.
3. Note the single result is report #413412, whose limited public disclosure contains none of these words besides XSS.
**How found:** Researcher searched Hacktivity for XSS-related reports, noticed report #413412 returned for a term absent from its public markup, hypothesized search indexes hidden limited-disclosure content, and tested with a word-list script.
**Exploitation:** Attacker iteratively adds candidate words to a Hacktivity search query and observes whether a specific limited-disclosure report still appears, confirming which words exist in the hidden title/description/comments.
**Escalation:** Scripted dictionary (top 3000 English words) probing to build a query isolating a single report and reconstruct hidden terms.
**Insight:** Search indexes built from mutable fields can retain pre-redaction terms; probe search endpoints with candidate words to test whether a redacted document still matches, especially after title edits.