3 ms·

It seems crazy that no thanks or recognition has been given. Is this because doing so might be seen as an admission of liability, and could be used in any lega

• didntcheck 3y ago
  To give the benefit of the doubt, it appears he only contacted them less than 48 hours ago. Their first priority should correctly be to fix the problem. They could be discussing a bug bounty right now and just haven't finalized the email yet
  • pge 3y ago
    American readers may not have noticed that the dates are in European DD/MM format, so they thought disclosure was Sept 1 rather than Jan 9.
    • MrDunham 3y ago
      I 100% saw it as MM/DD and was wondering why it took them three months to write up the vulnerability and a month to patch it. Thanks for the clarification
  • zopa 3y ago
    “Thanks for coming to us with this, we’re looking at it right away” wouldn’t take a lot of time or commit then to anything