Hall of Fame

Identified a critical application-level server-side Denial of Service vulnerability on the signup endpoint — no limit or length restriction on the password field allowed resource exhaustion attacks.

Discovered unauthorized access to update the profile of all users via an Insecure Direct Object Reference (IDOR) vulnerability, allowing any authenticated user to modify other users' profile data.

Reported multiple critical findings: exposed website .git folder leaking source code and credentials, GraphQL API accessible without a valid session token enabling unauthenticated data exposure, and GraphQL introspection left enabled leaking the full schema.

Responsibly disclosed three vulnerabilities: weak ciphers enabled on TLS configuration, missing X-Frame-Options header enabling clickjacking attacks, and failure to invalidate session tokens on password change.

Identified a session invalidation issue where changing an account password did not terminate existing sessions on other browsers or devices, allowing those sessions to remain active.

Reported untrusted and expired SSL certificates, exposed server information, missing Content Security Policy headers, missing Anti-Clickjacking headers, Cross-Domain JavaScript inclusion, private IP disclosure, Server Information Leakage via X-Powered-By header, and missing Strict-Transport-Security header.

Found a missing SPF safe check on email configuration and a clickjacking vulnerability due to absent X-Frame-Options headers.

Reported a clickjacking vulnerability where the server did not return an X-Frame-Options header, allowing the site to be embedded in malicious iframes.

Identified misconfigured SPF and DMARC DNS records that could expose the domain to email spoofing and phishing attacks.

Discovered the absence of an MTA-STS (Mail Transfer Agent Strict Transport Security) record, potentially exposing email communications to interception via downgrade attacks.