Starbucks Devs Leave API Key in GitHub Public Repo

guest · Dec 31, 2019

Starbucks Devs Leave API Key in GitHub Public Repo
December 31, 2019
https://www.bleepingcomputer.com/news/security/starbucks-devs-leave-api-key-in-github-public-repo/

One misstep from developers at Starbucks left exposed an API key that could be used by an attacker to access internal systems and manipulate the list of authorized users.
The severity rating of the vulnerability was set to critical as the key allowed access to a Starbucks JumpCloud API.
Serious impact
Vulnerability hunter Vinoth Kumar found the key in a public GitHub repository and disclosed it responsibly through the HackerOne vulnerability coordination and bug bounty platform.

Kumar reported the oversight on October 17 and close to three weeks later Starbucks responded it demonstrated "significant information disclosure" and that it qualified for a bug bounty.
Paying the bounties
Once Starbucks was content with the remediation steps taken, the company paid Kumar a $4,000 bounty for the disclosure, which is the maximum reward for critical vulnerabilities. Most bounties from Starbucks are between $250-$375.
Click to expand...

Log in or Sign up

Starbucks Devs Leave API Key in GitHub Public Repo

guest Guest

Log in or Sign up

Starbucks Devs Leave API Key in GitHub Public Repo

guest Guest

Useful Searches