Coinbase guys: if you'd like, we're happy to offer you a free 3 months of website vulnerability scanning to hopefully help you find and squash any vulnerabilities like this. Just email me at [email protected].

To anyone considering or currently using coinbase: this comment (if verifiably true) should be a GIANT red flashing light warning you to tread carefully.

It was frustrating that I didn't receive any contact from Coinbase until after posting on here HN, however I'd like to point out a couple things:

- This was a relatively minor XSS vulnerability which required a bit of social engineering to pull off, rather than being a traditional XSS that most HN readers would need to worry about.

- Their delayed response was likely due to the relative minor nature of this vulnerability.

- I still feel safe using Coinbase

- They're taking care of it and treating me well :)

We'll take a look. Thanks for the reminder!

This scares me.

Enable 2 factor authentication. IIRC Coinbase doesn't use it per user action, but at least having it has the potential to save you some headaches.