#disclosure
-
No Login Required: Breaking Down NumberBook's Caller-ID API
NumberBook asks for your entire contact list, then answers reverse phone lookups through a backend that has no authentication, no rate limiting, and 'encrypts' its responses with a key that ships inside the app itself.
-
One Bad Email Address, and a Dev Server Printed Its Database Password
A password-reset page on Shamela's development host answered an invalid email with an unhandled error, and the error page rendered the app's database credentials straight into the browser. The finding, why 'it's only dev' doesn't rescue it, and how I reported it.
-
From a Google Search Result to a Live Cloud Key: Inside the StoryGo App's Backend
A random IP in a Google result led to the Alibaba-Cloud backend of a reading app — a self-hosted GitLab/ZenTao/InfluxDB box, and a long-term Alibaba Cloud AccessKey hardcoded into the APK that a live proxy capture proved is still valid.
-
Arguing a 'Not Applicable' Verdict: A Laravel Debug Page That Leaked a Private Repo
A staging environment left Laravel debug mode on, leaking full stack traces, file paths, and a link to a private GitHub repository. The program marked it Not Applicable anyway, here's the finding, the back-and-forth, and why debug mode in production (or staging) is never really 'no impact.'
-
A Public sitemap.xml Isn't a Vulnerability, But What It Lists Might Be
A sitemap.xml disclosure report got closed as Informative, correctly, sitemap.xml is meant to be public. But the report also found a query-parameter trick that paginated through listed entries, including ones that weren't linked anywhere else. A look at where the line actually sits.
-
Arguing a 'Not Applicable' Verdict: Hardcoded Google Maps API Keys Aren't Free
A bug bounty report on a hardcoded, unrestricted Google Maps API key got marked Not Applicable, here's the technical rebuttal, the per-request cost math, and the precedent that makes this class of finding worth taking seriously.