News for hackers. Stuff that matters.

A comment on HackerOne breach lets outside hacker read customers’ private bug reports.

Re:HackerOne breach lets outside hacker read customers’ priv... by rvnx on Wednesday December 04, 2019 @02:45PM (#21706138)
The breach is here: https://hackerone.com/reports/745324

TL;DR: One user reported a bug to sign-in using cURL. HackerOne replied with admin credentials (session) to show that login works.

Nobody noticed. One guy logged in, downloaded a significant amount of sensitive data (private exploits!) and then told HackerOne. They give 20'000 USD to say nothing about it.

End of story.

[ Parent | on HN ]

There are no comments on this comment yet.