Every story and comment from the Hacker News API, in a layout borrowed from 2001.
A comment on Account Takeover via IDOR in Starbucks Singapore.
It is a big change from when I reported issues back in 2012[1] with them on the starbucks.com domains.
They were very nice though, and did let me keep a $200 credit which was quite rare at that time.
Also after they fixed it the SAME bug got reintroduced for some reason in 2015[2], and @homakov had the pleasure of reporting it again.
At the time I do NOT think they had any actual bounty programs like they do now.
I can only hope they now do proper regression testing for these types of issues.
[1] https://chadscira.com/post/556999d91cb00914380006ee/Re-Starb...
[2] http://sakurity.com/blog/2015/05/21/starbucks.html
There are no comments on this comment yet.
It is a big change from when I reported issues back in 2012[1] with them on the starbucks.com domains.
They were very nice though, and did let me keep a $200 credit which was quite rare at that time.
Also after they fixed it the SAME bug got reintroduced for some reason in 2015[2], and @homakov had the pleasure of reporting it again.
At the time I do NOT think they had any actual bounty programs like they do now.
I can only hope they now do proper regression testing for these types of issues.
[1] https://chadscira.com/post/556999d91cb00914380006ee/Re-Starb...
[2] http://sakurity.com/blog/2015/05/21/starbucks.html