Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

really bad stuff in the results. very easy to find API tokens, penetration test reports, confidental PDFs, internal APIs. Fiverr needs to immediately block all static asset access until this is resolved. business continuity should not be a concern here.


lots of admin credentials too, which have probably never been changed


admin passwords to dating sites, that's the stuff people get blackmailed with


How does someone's dating site password end up in Fiverr?


it's worse than you think – it's an admin password to the ~whole site~


How does an admin password to the whole site end up on Fiverr?


There are lots of passwords there (though one wonder if they were rotated). Basically, the people doing the hiring are sending PDFs with their credentials to the contractors to do the job.


Oh my. I feel for the tech team at fiverr. I'm sure it's nasty in there. Sending virtual hugs.


They have a dating site password! They can get real hugs.


Personally I have more sympathy for the people who were screwed over by the incompetence of at least some of that tech team


Meanwhile, I hope they get sent to prison for being so cavalier with other people's PII.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: