4 ms·
These folks never did a basic penn test ? Unauthenticated access to a different URL seems like a common thing to test for.
by mancerayder 4y ago
These folks never did a basic penn test ? Unauthenticated access to a different URL seems like a common thing to test for.
- acdha 4y agoThat's … optimistic in my experience. I've had reports include breathless disclosures that our application was leaking private information because robots.txt could be accessed without authentication, or that we were disclosing source code (front-end JavaScript). Places which treat security as an audit checkbox are going to try to outsource that work to save money and they're going to get people who have enough skill to run a few basic tools but not to reason about the results or do anything creative. Experian seems highly likely to be on that side since they've been able to avoid any significant penalties for past negligence.