It requires the user to click a link. But I still find this bounty very low. Others may not report them if such a small bounty is given.
> server-side vulnerabilities are worth very little, because they quickly get patched.
dont click links people
that'll be $500k for the security training pls
We've had to change our registration confirmation mails too recently to not confirm on GET only, but with another form - in hindsight it was stupid before but many services do that.
[0]: https://che01.safelinks.protection.outlook.com/?url=https%3A...
- "sign in via one-time code."
- "Click here to see our latest update".
99.9% of shops need a monolith with same monolith having entry points for background workers and crons.
Seasoned developers are unimpressed, or even disgusted, by the same massive piles of code.
I like the chain of regular old school things used to achieve it like post message, JSONP, iframe, Img tags.
I'm trying not to have any important data to even lose, when I eventually get hacked.
We can all turn up our noses, like the other commenters in this thread, but every one of them is exposed. Negligence is a matter of degrees.
This is the way. Respect user privacy and keep as little data as possible, and not only do you become a less attractive target, if you are targeted the outcome won’t be so bad.
Meanwhile the actual user of the account probably has to sign in using a yubikey because they get "CyBeRsEcRuItY aLeRtS" when they try to update node in their project to fix a crash and have to switch to daybreak blue to continue (or attempt to trick the normal models into doing it and risk getting autobanned)