3 ms·
There were two major problems: one serious enough to be a Bug Bounty submission, the other simply a clear backend bug: 1.CORS policy was wide open Anyone could
by liudasjank 10mo ago
There were two major problems: one serious enough to be a Bug Bounty submission, the other simply a clear backend bug:
1.CORS policy was wide open Anyone could call the internal ChatGPT API endpoint from any domain. Regardless of authentication mechanism, this is a real security concern.
2. 500 Internal Server Error on a 10 MB payload This is not something minor. This is a crash. And a bug.
And guess what? Both issues have now been fixed.