hackerone report vulnerability