8 High-Impact Bugs and How HackerOne Customers Avoided a Breach: Information Disclosure

This HackerOne blog post discusses Information Disclosure vulnerabilities, illustrating two real cases: a GraphQL endpoint on HackerOne that exposed personally identifiable information and a DoD Trace.axd page that exposed SSNs, credentials, and session tokens. The report covers impact assessment, rapid remediation (a two-hour fix for the HackerOne issue), bounty payouts, and the prevalence of information disclosure issues in the federal sector.