api vulnerability report hackerone