Hackerone reports idor