5 ms·

Well, the whole point of Beta program is to limit the participation and thus the exposure of attack vectors, and reduce the impact during the testing phase.

• OJFord 4y ago
  I suppose I wouldn't personally think of it as limiting exposure like that - prod is prod, beta feature or not - but if one does for a given product then yes sure it's a bad bug. Do we really think Cloudflare Email Routing private beta was private to somehow trusted parties only though? Presumably 'N-mutual trusted parties' too, for regulatory compliance. I assume not; not least because the product security lead is here in the comments saying they vetted logs etc. after the fact to ensure that only OP took advantage of this.
  • shyn3 4y ago
    I wouldn't rely on any companies logs or audit trail.
    • OJFord 4y ago
      Fine, not the point, they did it - implies the invitees weren't trusted 'they won't/doesn't matter if they do pwn each other' customers.
• nmjohn 4y ago
  I've built numerous systems that could be called "beta programs" - and the goal of none of them was security related - but rather product feedback related.
  • systemvoltage 4y ago
    I hope you also consider security problems as feedback.
    • OJFord 4y ago
      No, why are you shipping it to production if you need feedback on security? Beta feature security should be best effort, as good as anything else in production, because it is production, beta or not.