🎯 New Report #4000185: HackerOne Code sends live password-reset tokens to Segment in automatic page events
🔺Severity: Low
👽 Reporter: 1rhino2
⭐️ Reputation: 138
🛠 State: resolved
💼 Team: HackerOne
💵 Bounty: 200
🕐 Submitted: 2026-09-05
⏰ Disclosed: 2026-09-24 11:29:38
📝 Summary: A vulnerability was discovered in the HackerOne Code application, where opening a password-reset link automatically sent the complete unused 64-character reset token to Segment as the page loaded, before the reset form was submitted. The token was present in various fields of the Segment page event, which could potentially be accessed by anyone with read access to the Segment telemetry during the token's validity window.
📂 Report JSON File: 4000185
@hackeronereports