Leaking sensitive information on Github lead full access to all Grab Slack channels
该报告还没有中文解读。
原文摘录
摘自原文（5715 字符中的一小部分）
Accidental leakage of secret keys in such code repositories is a real problem, after my report #387117, I decided to dig deeper than the previous report and looking to some random profiles in Github, and doing some dirty work I was able to access to the developer’s company’s internal chats and …
原文中的代码
{
"installed": {
"client_id": "█████",
"project_id": "███████",
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
"token_uri": "https://accounts.google.com/o/oauth2/token",
"auth_provider_x509_cert_url": …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Grab 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @xsam · 版权归作者与 Grab 所有