Yeah, but we have no idea how long this has been unfixed. I reckon all security bugs not paid out to Uber at this point should just get automatically publicly documented.

Also: this is Uber. At this point, they’ve used up all their good faith. I definitely wouldn’t be taking anything they say in good faith - I still haven’t forgotten them threatening a journalist or publicly tracking the ride of a CEO for an entire room of people!