Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researcher finds flaw in a16z website that exposed some company data

kibty.town

Post reply on HN
Print view View original

61–70 of 246 posts

Re: Researcher finds flaw in a16z website that exposed some company data

#61

Post by paxys »

Drakim wrote: post #2

> a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because there was no available contact on their main site and the email i could find engineering@a16z.com bounced my emails That's a clever lifehack to save your company money, by not having any way to privately contact engineering all bug bounties wi…

The company doesn't need a "hack" to not pay money. If they don't have a published bug bounty program then they owe nothing.

They also have contact email addresses listed at the bottom of https://a16z.com/connect, which the researcher conveniently missed.

They were looking for clout, not responsible disclosure.

Re: Researcher finds flaw in a16z website that exposed some company data

#62

Post by bdowling »

tux3 wrote: post #3

>a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because: > there was no available contact on their main site > the email i could find engineering@a16z.com bounced my emails The age-old practice of screwing over security researchers over any possible technicality is still alive and well. Brings tears…

[flagged]

Re: Researcher finds flaw in a16z website that exposed some company data

#63

Post by Deathmax »

spyspy wrote: post #30
Havoc wrote: post #6

Pretty shitty to not even give a token amount bounty for such a broad hole

The next time someone finds their keys, they're going to find this article and commit them to a public github repo instead...

You don't want to push secrets in their raw form on GitHub, secret scanning would disable keys from supported providers.

Re: Researcher finds flaw in a16z website that exposed some company data

#65

Post by dmix »

asopd wrote: post #51
nlh wrote: post #31

Earlier quoted context omitted.

Counterpoint: OP is a security researcher and couldn’t find a single human email address at one of the most well-known VC firms on the planet? LinkedIn? Twitter? Facebook friends? Come on. They’re not hard to reach if one really wants to. (Note: I still think A16Z should have paid them.)

Exactly, if he even just browsed their website a bit he'd have stumbled across loads of email addresses that could have been a useful point of contact.

It’s more fun getting attention by doing it publicly and being the victim (security researchers love hitting the 'nobody respects us' button) than putting basic effort in.

A single email bouncing is frustrating of course, but he then posted that an easily found vulnerability existed on Twitter, while a16z:

- has a contact page page https://a16z.com/connect/ with 4x emails to their offices at the bottom (despite claims the main site had no other emails)

- links to their Twitter where DMs are open https://x.com/a16z same with instagram, FB, and linkedin, all open

it would be easy to just email all of them at once and waiting a couple days to see if it gets escalated.

Re: Researcher finds flaw in a16z website that exposed some company data

#67

Post by Retr0id »

bdowling wrote: post #62
tux3 wrote: post #3

>a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because: > there was no available contact on their main site > the email i could find engineering@a16z.com bounced my emails The age-old practice of screwing over security researchers over any possible technicality is still alive and well. Brings tears…

[flagged]

That's not what happened at all, and the article you link doesn't say that.

Re: Researcher finds flaw in a16z website that exposed some company data

#68

Post by rvnx »

paxys wrote: post #61
Drakim wrote: post #2

> a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because there was no available contact on their main site and the email i could find engineering@a16z.com bounced my emails That's a clever lifehack to save your company money, by not having any way to privately contact engineering all bug bounties wi…

The company doesn't need a "hack" to not pay money. If they don't have a published bug bounty program then they owe nothing. They also have contact email addresses listed at the bottom of https://a16z.com/connect , which the researcher conveniently missed. They were looking for clout, not responsible disclosure.

Let's imagine your backpack is open.

It's polite to say thanks if someone informs you that you accidentally left your backpack open.

But in no way you are supposed to give them anything.

Even further, some people take precious things from your backpack (trying to exploit the issue) and then come back to you asking for money; claiming they are nice people. This is non-sense.

Re: Researcher finds flaw in a16z website that exposed some company data

#69

Post by llmblockchain »

It's pretty shocking how many commenters are blaming the individual for not "trying harder" to find contact information. It's pretty clear a16z didn't want to pay anything or appreciate the disclosure at all.

Finding random email addresses and sending them a notice would have gone no where other than spam folders. I get dozens of "disclosures" every week from mostly script kiddies that think my DKIM setting is somehow going to be the end of my business. My brain automatically ignores emails like it.

Re: Researcher finds flaw in a16z website that exposed some company data

#70

Post by krig »

duggan wrote: post #19
krig wrote: post #14

Earlier quoted context omitted.

I’ve seen people make exactly this mistake with Next.js. IMO React server components is a fantastic tool for losing track of what’s exposed client side and what isn’t.

Next.js makes you prefix env vars with NEXT_PUBLIC_ if you want them to be available client side, and Vercel has warning flags around it when you paste in those keys. It's obviously not foolproof, but it's a good effort.

That’s env vars, but not actual variables - it’s really easy (if you are not actively context aware) to f.ex. pass a ”user” object from a server context into a client component and expose passwords etc to the client side.
Post reply on HN