Bug Hunters Dump User Data. Can They Keep it? Well They're Keeping it Anyway.

Overview: Co-founder of Truffle Security and attorney Whitney examine the legal and practical data retention dilemmas that arise when bug bounty researchers inadvertently capture sensitive user data. While standard bug bounty policies (such as Uber's) explicitly mandate that hunters test only on their own accounts and refrain from accessing user data, blind vulnerabilities frequently cause accidental mass data exfiltration. The presentation explores how captured customer data proliferates across researcher infrastructure and third-party tools without standardized protocols for verifiable deletion.

Key Topics: - Conflict between bug bounty policies ("test only your own account") and practical testing - Blind Cross-Site Scripting (Blind XSS) and accidental bulk user data exposure - Proliferation of exfiltrated data across researcher tooling, local disks, and cloud providers - Absence of deletion workflows and retention controls on bug bounty platforms

Technical Details: The speakers detail an incident involving blind cross-site scripting (Blind XSS) testing where an injection payload placed in a username field executed within an internal administrative dashboard. The injected JavaScript triggered an automated screenshot and exfiltration routine via XSS Hunter when the dashboard rendered the unescaped username alongside a complete listing of all system users. While the researcher acted transparently by attaching all screenshots and replication steps to the vulnerability report, the incident exposed significant architectural and procedural data retention gaps.

The talk maps how a single proof-of-concept capture caused sensitive customer data to duplicate across multiple unmanaged endpoints: from the employee's browser to XSS Hunter (hosted on third-party AWS infrastructure), through notification emails stored on Gmail servers, down to local hard drives and automated macOS Time Machine backup volumes, and finally into the bug bounty platform's ticket database. When attempting to remediate the exposure, the researcher found that XSS Hunter provided a delete button without clear terms of service or verifiable deletion backend guarantees, while major platforms like HackerOne and Bugcrowd lacked any user-facing deletion mechanisms to purge sensitive attachments from resolved tickets. Discussions with prominent bug hunters confirmed that years after reports are closed, researchers retain persistent access to download historical customer data from their platform dashboards, while programs routinely deny public disclosure requests to obscure these retention flaws.

Key Takeaways: Bug bounty programs must establish clear post-remediation data sanitization procedures rather than assuming researchers maintain data isolation. Organizations should audit third-party vulnerability management platforms to verify that sensitive attachments can be permanently deleted after triage. Security teams and bug bounty platforms need verifiable data disposal workflows and secure proof-of-concept guidelines that avoid capturing production user tables during blind XSS and injection testing.

(AI summary — Gemini Flash)