# Export endpoints bypassing visibility rules

Export or bundle endpoints that skip privacy, removal, or disclosure filters applied elsewhere

_Area: Web access control and IDOR. Seen in 4 disclosed reports; 3 confirmed bounties, median $10,000, range $100-$12,500; latest 2026-08-01. Updated 2026-10-23._

## How it works
An export or bundle endpoint re-implements data selection instead of reusing the canonical visibility-gated query. It assumes that if a record is reachable, it is exportable. That assumption breaks when visibility is stored as a frozen column set at write time, when removal is tracked separately from the record, or when a new code path simply forgets the filter the normal view applies. The result is that private, opted-out, removed, or restricted content flows out through a path that never checked the viewer's rights.

## Where it shows up
- Export, zip, bundle, or bulk-download endpoints that assemble their own query rather than calling the shared visibility filter.
- Denormalized visibility columns (e.g. a `visibility` field set once at payment time and never updated) used as the sole gate.
- Privacy opt-outs stored in separate tables (`hide_giving`, `hide_from_lists`, opt-in tables) that the export join omits.
- Removal or redaction status tracked apart from the attachment/comment record, so the export still includes it.
- Newly shipped export features on objects with limited disclosure, redaction, or internal-only flags.

## How to review
The invariant: every export must return exactly the set of records the requesting viewer could see through the canonical view, no more. Check that the export calls the same visibility-gated query or filter as the normal read path, not a parallel one. Verify each privacy/removal flag is applied: opt-outs, opt-ins, frozen visibility, removal status, disclosure level. Confirm the viewer's identity and role are enforced on the export, not just on the UI. Diff the export's WHERE clauses against the canonical query field by field.

## Variants seen
- Payments export joined payer only on frozen `visibility=3`, ignoring `hide_giving`, `hide_from_lists`, and opt-in tables [E1](https://bugbountylibrary.com/r/h1%3A3878586.md).
- Zip export bundled internal attachments removed from a disclosed report, unfiltered by viewer visibility or removal status [E2](https://bugbountylibrary.com/r/h1%3A186230.md).
- Zip export included comments from limited-disclosure reports that the report view hid [E3](https://bugbountylibrary.com/r/h1%3A182358.md).

## Why fixes fail
Partial fixes leave the artifact reachable through the same export path; re-running the original PoC against the same object after a disclosed fix is needed to confirm closure [E2](https://bugbountylibrary.com/r/h1%3A186230.md).

## Impact and severity
Leaked donor identity, amount, and date for opted-out or since-privatized donations [E1](https://bugbountylibrary.com/r/h1%3A3878586.md); exposed team-only and removed files [E2](https://bugbountylibrary.com/r/h1%3A186230.md); revealed restricted timeline activity [E3](https://bugbountylibrary.com/r/h1%3A182358.md). Severity rises when the export is unauthenticated or reachable by any user, and when frozen visibility columns make the leak persist silently after privacy changes.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A3878586.md
- E2: https://bugbountylibrary.com/r/h1%3A186230.md
- E3: https://bugbountylibrary.com/r/h1%3A182358.md