3 ms·
Did he actually need to download all of their source code to prove the vulnerability though? It seemed that he could have simply stopped when he extracted ref H
by verroq 8y ago
Did he actually need to download all of their source code to prove the vulnerability though? It seemed that he could have simply stopped when he extracted ref HEAD. It is this extra exploitation that gets researchers into trouble.
- shawnz 8y agoYes, it was necessary to download all the code to prove for example that it wasn't just unrelated data in that repo. Furthermore a big part of this issue is that database keys were stored in the repo. Source code of the site alone wouldn't have been so critical.