2 ms·
Author links to the docs, but fails to mention if they emailed security@stytch.com - which has not only been in docs since at least late 2021, but also found do
by O__________O 4y ago
Author links to the docs, but fails to mention if they emailed security@stytch.com - which has not only been in docs since at least late 2021, but also found doing a simple Google:
- https://stytch.com/docs/#security_overview https://stytch.com/docs/#security_overview
* Note: Search for “security@“ on link above.
- https://web.archive.org/web/20210801185042/https://stytch.com/docs/ https://web.archive.org/web/20210801185042/https://stytch.co...
- https://www.google.com/search?q=stytch+security+disclosure https://www.google.com/search?q=stytch+security+disclosure
To me, little strange to be so critical and have obviously spent time to research and document their findings, then fail to do even basic due diligence.
Also appears author is posting this anonymously, which given the prior information, makes me wonder what their motives are. To me, this feels more like an attack than responsible disclosure. Flagging the post.
- sam0x17 4y ago* "The Wayback Machine has not archived that URL." * The google search you linked it took me 2 minutes staring at the results page before I notifed the part where the relevant information comes up. It's on a sub-link with the heading "Docs", 80% of the way down the page in an h3. That's pretty damn buried. I think it's safe to say they essentially phoned in and checked the box on the whole security disclosure thing. Do they meet the requirement technically? Yes. But the info is actually pretty buried so much so that archive.org has never seen it before. Should be on their site footer.
- O__________O 4y agoStytch CEO posted a response here: https://news.ycombinator.com/item?id=33164969 https://news.ycombinator.com/item?id=33164969