Researcher finds flaw in a16z website that exposed some company data
1–10 of 246 posts
Re: Researcher finds flaw in a16z website that exposed some company data
#2> a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because there was no available contact on their main site and the email i could find engineering@a16z.com bounced my emails
That's a clever lifehack to save your company money, by not having any way to privately contact engineering all bug bounties will have to be reported publicly which means you don't need to pay anything.
Re: Researcher finds flaw in a16z website that exposed some company data
#3 >a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because:
> there was no available contact on their main site
> the email i could find engineering@a16z.com bounced my emails
Re: Researcher finds flaw in a16z website that exposed some company data
#4When we released our open-source project[1], this hacker (Eva) pentested our project pretty extensively and was very professional in their disclosures. They didn't even ask for a bounty since we didn't have a program back then!
Eva is an incredibly gifted hacker and a responsible one, a16z should treat them better.
Re: Researcher finds flaw in a16z website that exposed some company data
#5I agree that the bounty outcome is unfair.
Re: Researcher finds flaw in a16z website that exposed some company data
#6Pretty shitty to not even give a token amount bounty for such a broad hole
Re: Researcher finds flaw in a16z website that exposed some company data
#7when companies say they are “hacked”, it’s now a corporate term for “we were negligent in securing important credentials, but please shift blame to this no-name entity we called a ‘hacker’”
Re: Researcher finds flaw in a16z website that exposed some company data
#8I made a similar mistake actually.
We used a nodejs cms called apostrophecms that had an admin panel called global settings.
We used that for managing api keys to our auth server.
We only found out a few months in that it was outputted in the html source code. They did this so it was available to JS, of course it was in their docs. So not blaming them. We glossed over it.
Annoyingly we paid a reasonable amount of money for a pen test with one of the big consultancy companies but they also didn’t see it.
I ended up finding it and checking the logs seems like it wasn’t abused but it was shocking and a big leak
Re: Researcher finds flaw in a16z website that exposed some company data
#9Sincere question: how do you actually make this mistake while having the skills to build a web app of this complexity level? All the frontend and full stack frameworks that I’m familiar with try pretty hard to stop you.
Re: Researcher finds flaw in a16z website that exposed some company data
#10they are busy writing a giant "architecture of generative AI" whitepaper.
give them a pause, they are dreaming a future agentic world of half-assed chatbots.
while the world burns with botched software updates.