Can confirm, not arrested but threatened with litigation/employer contacted for responsible disclosure of unsanitized user input allowing arbitrary access to protected data of presumably any user. Just a url query param value flipped from true to false. Incrementing int user id too, so enumeration is trivial and the response payload was json so no need to do anything.

It is amazing what a casual observer with a background in web dev will see if they just open devtools. It has instilled a deep aversion in me to give any service any of my data that I care about protecting.

▲

tough a day ago | parent [-]

There should be an anonymous org way to report these without putting yourself in personal jeopardy, some kind of "innocent observer" protections built in...

If your system has gaps im not at fault for discovering them sort of deal

▲

socalgal2 a day ago | parent | next [-]

Unfortunately the anonymous org will then get abused by bad actors because of its anonymousness which leaves us where we are today

▲

flir a day ago | parent | prev [-]

Long, long ago we had anonymous remailers.

It was a different time. Today, I don't think I'd trust an intermediary set up to - essentially - pass along 0-days not to sleep on the juicy ones.

	▲	tough 21 hours ago \| parent [-]
		wasn't that the origin of crypto and bitcoin too, or similar communities at least. I think that's where I've read from about remailers in the past as in the same people who mined bitcoin early was into these