4 ms·
Mike from Instagram here. We've now locked it down more (the actual admin contents were always properly protected). We're also part of Facebook's bug bounty wh
by mikeyk 13y ago
Mike from Instagram here. We've now locked it down more (the actual admin contents were always properly protected).
We're also part of Facebook's bug bounty whitehat program (https://www.facebook.com/whitehat/bounty/ https://www.facebook.com/whitehat/bounty/), if anyone comes across something in the future, we welcome responsible disclosure and pay out bounties through the program as well.
- MattBearman 13y agoOut of interest, would something as easy to find as this qualify for the bug bounty?
- davis_m 13y agoI would hope so. It shouldn't matter how "easy" something is to find. If the bug was really that easy, the team should have never let it out onto production.
- tptacek 13y agoOff the top of my head I can't speak to Facebook's program, but Google's terms include "substantially affects the confidentiality or integrity of user data". A login page that shouldn't be exposed is a marginal finding and might not qualify. Also: obviously I don't speak for either Facebook or Google, but I strongly recommend against brute-forcing login prompts to try to prove the point that an exposed console is a real finding.
- dylangs1030 13y ago"Report a bug that could compromise the integrity of Facebook user data, circumvent the privacy protections of Facebook user data, or enable access to a system within the Facebook infrastructure" ^That's Facebook's. Theoretically, an exposed login page "could...enable access to a system within the Facebook infrastructure", but to be fair, I doubt they had that in mind.