#secrets
-
One Bad Email Address, and a Dev Server Printed Its Database Password
A password-reset page on Shamela's development host answered an invalid email with an unhandled error, and the error page rendered the app's database credentials straight into the browser. The finding, why 'it's only dev' doesn't rescue it, and how I reported it.
-
From a Google Search Result to a Live Cloud Key: Inside the StoryGo App's Backend
A random IP in a Google result led to the Alibaba-Cloud backend of a reading app — a self-hosted GitLab/ZenTao/InfluxDB box, and a long-term Alibaba Cloud AccessKey hardcoded into the APK that a live proxy capture proved is still valid.