Any one can view collaborater email address via path /reports//participants

HackerOne disclosed a bug submitted by alone_h1: https://hackerone.com/reports/1918362 – Bounty: $500