News for hackers. Stuff that matters.

A comment on SolarWinds leaked FTP credentials through a public GitHub repo since 2018. Parent comment

Re:SolarWinds leaked FTP credentials through a public GitHub... by hackerpain on Wednesday December 16, 2020 @10:05AM (#25443377)
I have found a LARGE social media having a similar kind of vulnerability. Downloaded some data as Proof of concept. There's no way to reach their CEO and no security contact.

How should I report it in your opinion?

[ Parent | on HN ]
Re:SolarWinds leaked FTP credentials through a public GitHub... by mackenzie-gg on Wednesday December 16, 2020 @10:44AM (#25443891)
Check HackerOne to see if the company is listed. This is a site where white hat hackers can post vulnerabilities and in return get rewarded for bounties. If you have information on a vulnerability for a large social media, you might be looking at a nice reward. https://www.hackerone.com/product/bounty
[ Parent | on HN ]
Re:SolarWinds leaked FTP credentials through a public GitHub... by hackerpain on Wednesday December 16, 2020 @11:00PM (#25452289)
It's not. They may have a private program, don't know.
[ Parent | on HN ]
Re:SolarWinds leaked FTP credentials through a public GitHub... by ceejayoz on Wednesday December 16, 2020 @10:08AM (#25443421)
Depends on the site, the data involved, your jurisdiction, their jurisdiction, etc.

In the EU, you might be able to report it to a regulator. In Russia, perhaps not.

[ Parent | on HN ]