title: "Limiting Disclosed Information"

path: "/programs/limiting-disclosed-information.html"

id: "programs/limiting-disclosed-information"

When disclosing reports, you can choose to limit the information that’s shared instead of disclosing the report in full detail. There are 2 ways you can limit information:

* Redacting sensitive information

* Limiting visibility

You can choose to limit information published in a report at the time you disclose the report and after the report has been made public.

Some reports may contain sensitive information or information that’s not meant to be for the general public. Redacting reports enables you to censor specific words or characters from being visible to readers. Once you redact any string, the specified string will be blacked out throughout the report as seen in the image below. Keep in mind that once you redact something from a report, it’ll permanently and irreversibly be redacted.


To redact information from a report:

1. Go to the report you want to redact.

2. Find the **Visibility** field in the report metadata.

3. Click **Redact**.


4. Enter the string that you want to redact from the report.


5. <i>(Optional)</i> Click **Preview** to see how the redactions will look in the report.

6. Click **Redact**.

If you have multiple strings that you want to redact, repeat steps 2-6.

In addition to redacting reports, you can limit the visibility of reports by selecting to have Limited disclosure. When you select to have limited instead of full public disclosure, only the summary and timeline of the report are visible and all comments and attachments are hidden.


If your report is already fully disclosed, click **Public (Full)** in the report metadata to toggle the report to have limited disclosure. You can toggle between Full and Limited disclosure at anytime. Just click **Public (Limited)** to toggle back to full disclosure.


To disclose your report, follow the steps to [request public disclosure](public-disclosure.html).

Here's a good example of a limited disclosure report from the Shopify security team: https://hackerone.com/reports/64164.

Disclosure by Default | The hacker or your security team can request public disclosure for any closed report in your program. If the admin of your program agrees to disclosure, the contents of the report will be made public within 30 days.<br> <br>*This is the default setting for all verified programs*.

Disclosure requiring Mutual Agreement | The hacker can request public disclosure for any closed report in your program. If your program security team agrees to disclosure, the contents of the report will be made public. If the security team doesn't take any action, the contents of the report will remain private. <br>*You must request to opt-in to this option.*

1) Go to the report you want to publicly disclose.

2) Make sure the report is closed.

3) Select **Request public disclosure** in the action picker at the bottom of the report.

4) Select whether you want to disclose the **Full** report or **Limited**.

Full | Upon public disclosure, the full contents of the report are visible including the:<li>Vulnerability information</li><li>Summary</li><li>Timeline which includes comments and attachments</li><br>*Note: Internal comments are kept hidden.*

5) *(Optional)* Enter a comment to describe your reasons for public disclosure.

After public disclosure has been requested, the admin of the of the program can choose to publicly disclose the report. They can select **Disclose publicly** to disclose the report.

This diagram illustrates HackerOne's public disclosure process:

items:

- title: Limiting Disclosed Information

path: /programs/limiting-disclosed-information.html