3 ms·
(disclaimer: I'm one of the creators of this very unnamed service) The XSS-issue that was found by Tim was indeed a very fundamental problem which shouldn't ha
by bresj 7y ago
(disclaimer: I'm one of the creators of this very unnamed service)
The XSS-issue that was found by Tim was indeed a very fundamental problem which shouldn't have been in there. We are very happy he disclosed the information with us so we could fix it directly.
We hired a couple of professional hackers to audit our service but launched simultaneously. Biggest lesson for us: finish the audit first, launch afterwards :-)
- say_it_as_it_is 7y agoI'm going to give your tech team the benefit of the doubt that it would have responded to information quickly if it had that information. Lessons learned here: pay your pen testers quickly because their findings can affect the reputation of your company, don't launch without responding to audit results, don't bullshit people working in high tech industries about what was happening simultaneously, don't blame tech staff for business decisions