Ask HN: I know how to reset any Nexmo.com account, but nobody cares

Re:Ask HN: I know how to reset any Nexmo.com account, but no... by marcuzhn on Friday July 24, 2015 @11:30AM (#9942643)

I am not 100% sure about the legal details, but Nexmo as a company has a bug bounty reward program, so I assume in our case it doesn't apply because we want to know what's wrong and we request responsible disclosure (usually after the fix is in production). You can see it here: https://cobalt.io/nexmo (yes, it isn't yet linked from our www).

[ Parent | on HN ]

Re:Ask HN: I know how to reset any Nexmo.com account, but no... by hluska on Friday July 24, 2015 @11:59AM (#9942873)

So, let's see if I understand this.

- Your website has no security page and setting this up is such a low priority that you have no ETA on when /security might exist.

- You instead use a third party service to manage your security disclosures. Yet, you don't link to this site from your website.

- A researcher tries to contact you again and again. He gets no reasonable response so after several months he posts on Hacker News.

The Hacker News post finally gets a response, yet you expect us to believe that you care about security???

[ Parent | on HN ]

Re:Ask HN: I know how to reset any Nexmo.com account, but no... by JosephRedfern on Friday July 24, 2015 @11:36AM (#9942690)

Only API's seem to be listed as in-scope, though. dashboard.nexmo.com (as well as www., and many other subdomains) are explicitly listed as being out of scope :).

[ Parent | on HN ]

Re:Ask HN: I know how to reset any Nexmo.com account, but no... by marcuzhn on Friday July 24, 2015 @11:43AM (#9942748)

LOL I expected that. Simple reason: we have received a good number of reports for our dashboard and some of them are still open mostly because they are not top priority. Needless to say we accept all reports and reward them accordingly to severity. :)

[ Parent | on HN ]