3 ms·
The breach is here: https://hackerone.com/reports/745324 https://hackerone.com/reports/745324 TL;DR: One user reported a bug to sign-in using cURL. HackerOne r
by rvnx 7y ago
The breach is here: https://hackerone.com/reports/745324 https://hackerone.com/reports/745324
TL;DR:
One user reported a bug to sign-in using cURL.
HackerOne replied with admin credentials (session) to show that login works.
Nobody noticed.
One guy logged in, downloaded a significant amount of sensitive data (private exploits!) and then told HackerOne.
They give 20'000 USD to say nothing about it.
End of story.