3 ms·

Apparently he tried talking with Panera directly. First contact was 6 months ago. The vulnerability still exists so he decided to release it publically. I th

Apparently he tried talking with Panera directly. First contact was 6 months ago. The vulnerability still exists so he decided to release it publically. I think that's reasonable.

r00fus 9y ago
And it's fixed immediately after release. 180 days seems about 90 days more than what major vendors get. I bet this vulnerability was open for years.
- erichurkman 9y ago
  I certainly have a few open reports to companies that I've been trying to reach for, in several cases, _years_. Or, in other cases, I found something but trying to reach the right person is nigh impossible. security@ bounces, general support is useless, no one responds on linkedin, no one responds to direct emails, pinging them on twitter does nil. Extremely sad.
- ethanwillis 9y ago
  It wasn't fixed immediately after release. Apparently all they did at first was: 1.) Take down site for 2 hours 2.) Require logins to access api. 3.) Get on fox news and say it's "fixed" ... then we come to find out you can still access all data from the API once you login