Attachment in published HackerOne report exposure private program