# Hidden identifiers leak private accounts

Private fields hidden by UI or privacy settings returned by side-channel APIs, tokens, or SSR blobs

_Area: Web access control and IDOR. Seen in 7 disclosed reports; 5 confirmed bounties, median $1,000, range $100-$7,500; latest 2022-10-09. Updated 2026-10-23._

## How it works
A privacy control is enforced on one path (the UI, the main read endpoint, one client) but the same data is served by a side-channel response that never applies it. The broken assumption: hiding a field in the interface, or honoring a discoverability toggle on the profile view, protects the value everywhere. Stable identifiers (user_id, email, username, shop ID, invite token, phone) come back from mutation responses, SSR hydration blobs, alternate clients, and token dereference endpoints. Because the identifier is stable, it links an anonymous or private account to a real person.

## Where it shows up
- Mutation endpoints (friend request, star/like) echoing the full resource object [E4](https://bugbountylibrary.com/r/h1%3A162822.md)[E6](https://bugbountylibrary.com/r/h1%3A1245741.md)
- GraphQL objects exposing tokens or fields the UI never renders [E1](https://bugbountylibrary.com/r/h1%3A807448.md)
- SSR hydration blobs: Hypernova props, __NEXT_DATA__, window.__INITIAL_STATE__ [E3](https://bugbountylibrary.com/r/h1%3A421009.md)
- Map/mobile APIs returning richer fields than the web UI [E2](https://bugbountylibrary.com/r/blog%3Amalgregator-com-post-waze-how-i-tracked-your-mother.md)[E8](https://bugbountylibrary.com/r/blog%3A7elements-co-uk-resources-blog-facebooks-burglary-shopping-list.md)
- Migration/merge conflict forms pre-filling another account's email or id [E5](https://bugbountylibrary.com/r/h1%3A1727044.md)
- Invite list endpoints returning the acceptance key to the inviter [E7](https://bugbountylibrary.com/r/h1%3A1040047.md)

## How to review
For each private field, find every path that returns it and confirm the same authorization and privacy check runs on all of them. The invariant: a value hidden by UI or a privacy setting must be absent from every response, including side-effect endpoints, alternate clients, and token dereference. Diff raw API JSON against what the UI displays; grep hydration blobs for IDs and PII; verify mutation and migration responses honor visibility and show-name settings rather than reflecting stored identifiers.

## Variants seen
- Invite token dereferenced to invitee email via JSON endpoint [E1](https://bugbountylibrary.com/r/h1%3A807448.md)
- Map API returns stable IDs/usernames the UI hides [E2](https://bugbountylibrary.com/r/blog%3Amalgregator-com-post-waze-how-i-tracked-your-mother.md)
- SSR props serialize private shop ID, owner name, email [E3](https://bugbountylibrary.com/r/h1%3A421009.md)
- Star-toggle response returns user_name despite privacy toggles [E4](https://bugbountylibrary.com/r/h1%3A162822.md)
- Migration conflict page reflects another user's email [E5](https://bugbountylibrary.com/r/h1%3A1727044.md)
- Friend-request response returns phone number before acceptance [E6](https://bugbountylibrary.com/r/h1%3A1245741.md)
- Invite key returned to inviter lets them complete signup for the invitee, bypassing email verification [E7](https://bugbountylibrary.com/r/h1%3A1040047.md)
- Mobile GraphQL returns exact coordinates where web UI fuzzes location [E8](https://bugbountylibrary.com/r/blog%3A7elements-co-uk-resources-blog-facebooks-burglary-shopping-list.md)

## Why fixes fail
Privacy checks applied only to read endpoints miss mutation endpoints returning the same object [E4](https://bugbountylibrary.com/r/h1%3A162822.md); UI hiding is mistaken for server enforcement [E2](https://bugbountylibrary.com/r/blog%3Amalgregator-com-post-waze-how-i-tracked-your-mother.md)[E3](https://bugbountylibrary.com/r/h1%3A421009.md); a token treated as opaque is still dereferenceable to PII [E1](https://bugbountylibrary.com/r/h1%3A807448.md); fuzzing applied in one client is absent in another [E8](https://bugbountylibrary.com/r/blog%3A7elements-co-uk-resources-blog-facebooks-burglary-shopping-list.md).

## Impact and severity
Deanonymization and tracking of users who set privacy controls [E2](https://bugbountylibrary.com/r/blog%3Amalgregator-com-post-waze-how-i-tracked-your-mother.md)[E8](https://bugbountylibrary.com/r/blog%3A7elements-co-uk-resources-blog-facebooks-burglary-shopping-list.md), exposure of private emails, real names and phone numbers [E1](https://bugbountylibrary.com/r/h1%3A807448.md)[E3](https://bugbountylibrary.com/r/h1%3A421009.md)[E5](https://bugbountylibrary.com/r/h1%3A1727044.md)[E6](https://bugbountylibrary.com/r/h1%3A1245741.md), and verification bypass via leaked invite keys [E7](https://bugbountylibrary.com/r/h1%3A1040047.md). Severity rises when identifiers are stable and enumerable and when the leak defeats an explicitly advertised privacy promise.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A807448.md
- E2: https://bugbountylibrary.com/r/blog%3Amalgregator-com-post-waze-how-i-tracked-your-mother.md
- E3: https://bugbountylibrary.com/r/h1%3A421009.md
- E4: https://bugbountylibrary.com/r/h1%3A162822.md
- E5: https://bugbountylibrary.com/r/h1%3A1727044.md
- E6: https://bugbountylibrary.com/r/h1%3A1245741.md
- E7: https://bugbountylibrary.com/r/h1%3A1040047.md
- E8: https://bugbountylibrary.com/r/blog%3A7elements-co-uk-resources-blog-facebooks-burglary-shopping-list.md