Cloudflare Public Bug Bounty · Report #1507412
API docs expose an active token for the sample domain theburritobot.com
Validstatus
highseverity
$500bounty
28upvotes
27 Jun 2022disclosed
Summary
A screenshot featured on API token creation documentation page exposed a valid API token with permissions sufficient to modify DNS records of one of Cloudflare’s demo zones. The token has since been revoked.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.