2 ms·

i hope that twitter has 24/7 team to respond to this.

• swartkrans 12y ago
  I wonder if he's actually qualified for any bug bounty given the public announcement, even with the dangerous parts blacked out.
  • chavesn 12y ago
    Probably not; seems to me like a pretty dumb thing to do if he wanted any bounty. The domain is nearly as dangerous as the URL, since it leads attackers directly to the vulnerable server(s).
  • damian2000 12y ago
    Terms of their bug bounty program just says "You may not publicly disclose the vulnerability prior to our resolution" ... https://hackerone.com/twitter https://hackerone.com/twitter