3 ms·

I was looking at jobs for my son at Safeway supermarkets and lazily put https://www.safeway.com/jobs https://www.safeway.com/jobs in the browser. That redirect

I was looking at jobs for my son at Safeway supermarkets and lazily put https://www.safeway.com/jobs https://www.safeway.com/jobs in the browser. That redirects to https://www.careersatsafeway.com/desktop/home https://www.careersatsafeway.com/desktop/home -- which is very much not about jobs at safeway -- appears to be an Indonesian gambling/gaming site. Safeway.com has zero email contacts published and expects communication to be via phone call or chatbot. I found their domain admin email and sent them info with no response, and no change to their site behavior. This makes me think that they might be ripe for more monkey business but that's not my thing. Oh well.

iamhamm 3y ago
Hi Albertsons/Safeway VP of Security Engineering here. Thank you for disclosing this. I’ll have it fixed along with the fact our VDP submission link is missing from the Safeway site. Here it is for future reference https://albertsons.responsibledisclosure.com/hc/en-us https://albertsons.responsibledisclosure.com/hc/en-us
- alright2565 3y ago
  Please also add a security.txt file so that it is not necessary to navigate through a labyrinthine site to get this information. https://datatracker.ietf.org/doc/html/rfc9116 https://datatracker.ietf.org/doc/html/rfc9116
- forward1 3y ago
  It's definitely not fixed: the (likely malicious?) redirect still happens for me now. How embarassing (for you).
- pstuart 3y ago
  Hi! I was wondering if it would get noticed here ;-) But as noted elsewhere, it's still not fixed. And the link you shared is a good thing but is that going to be easy to find to someone who sees an issue with your websites? I'd recommend putting a link here: https://www.safeway.com/help/contactus https://www.safeway.com/help/contactus
- pstuart 3y ago
  As it's still not fixed, I tried the form there. It let me fill it out and send it in and then told me I needed to create an account, which made it appear that my submission wasn't sent. I've done enough here but ffs, if that form requires an account to be created beforehand then don't let the submitter go to the trouble of filling it out and then discard it.
  - pstuart 3y ago
    Edit: my bad. Looks like browser cache was "helping out". Problem is resolved from my vantage point.
0xDEADFED5 3y ago
what the hell, i see the same thing. it's crazy to me when large companies don't even have an option for: in case of dumpster fire, send an email here.
- pstuart 3y ago
  Technically it's not my problem (or on any other basis), but it bothers me because I'm weird. I was tempted to find their CTO on linked in and post a message there, along with the fact that there was no reply to my outreach nor a proper channel to do so. I think the only think in their defense is that they must get a lot of angry customer messages and they just don't want to deal with that.
  - deleted 3y ago
    [deleted]
  - namdnay 3y ago
    I very much doubt it's got anything to do with their CTO - the management of a corporate website is usually jealously guarded by marketing/corporate communications
    - pstuart 3y ago
      Yes, the CTO hopefully has nothing to do with lower level operations like that. But if they get a public burn they're going to issue a decree that will be addressed.
      - namdnay 3y ago
        No what I mean is that it won’t even be in their org. The public website will belong to the head of corporate communications or some similar chief bullshit officer
        pstuart 3y ago
        Ah, yes. It looks like my post here did get the security folk involved -- but it appears that they've yet to fix it. The power of Hacker News!
RamblingCTO 3y ago
Seems to be fixed: This request was blocked by our security service
- PopAlongKid 3y ago
  Not fixed where I am.

iamhamm 3y ago

Hi Albertsons/Safeway VP of Security Engineering here. Thank you for disclosing this. I’ll have it fixed along with the fact our VDP submission link is missing from the Safeway site. Here it is for future reference https://albertsons.responsibledisclosure.com/hc/en-us https://albertsons.responsibledisclosure.com/hc/en-us

alright2565 3y ago
Please also add a security.txt file so that it is not necessary to navigate through a labyrinthine site to get this information. https://datatracker.ietf.org/doc/html/rfc9116 https://datatracker.ietf.org/doc/html/rfc9116
forward1 3y ago
It's definitely not fixed: the (likely malicious?) redirect still happens for me now. How embarassing (for you).
pstuart 3y ago
Hi! I was wondering if it would get noticed here ;-) But as noted elsewhere, it's still not fixed. And the link you shared is a good thing but is that going to be easy to find to someone who sees an issue with your websites? I'd recommend putting a link here: https://www.safeway.com/help/contactus https://www.safeway.com/help/contactus
pstuart 3y ago
As it's still not fixed, I tried the form there. It let me fill it out and send it in and then told me I needed to create an account, which made it appear that my submission wasn't sent. I've done enough here but ffs, if that form requires an account to be created beforehand then don't let the submitter go to the trouble of filling it out and then discard it.
- pstuart 3y ago
  Edit: my bad. Looks like browser cache was "helping out". Problem is resolved from my vantage point.

0xDEADFED5 3y ago

what the hell, i see the same thing. it's crazy to me when large companies don't even have an option for: in case of dumpster fire, send an email here.

pstuart 3y ago
Technically it's not my problem (or on any other basis), but it bothers me because I'm weird. I was tempted to find their CTO on linked in and post a message there, along with the fact that there was no reply to my outreach nor a proper channel to do so. I think the only think in their defense is that they must get a lot of angry customer messages and they just don't want to deal with that.
- deleted 3y ago
  [deleted]
- namdnay 3y ago
  I very much doubt it's got anything to do with their CTO - the management of a corporate website is usually jealously guarded by marketing/corporate communications
  - pstuart 3y ago
    Yes, the CTO hopefully has nothing to do with lower level operations like that. But if they get a public burn they're going to issue a decree that will be addressed.
    - namdnay 3y ago
      No what I mean is that it won’t even be in their org. The public website will belong to the head of corporate communications or some similar chief bullshit officer
      - pstuart 3y ago
        Ah, yes. It looks like my post here did get the security folk involved -- but it appears that they've yet to fix it. The power of Hacker News!

RamblingCTO 3y ago

Seems to be fixed: This request was blocked by our security service

PopAlongKid 3y ago
Not fixed where I am.