MetaMask · Report #1523651
Public Postman Api Collection Leaks Internal access to https://assets-paris-dev.codefi.network/
Validstatus
mediumseverity
$500bounty
19upvotes
14 May 2022disclosed
Summary
The researcher identified a public workspace at https://www.postman.com/3zL77NHP5yLSKc/workspace/codefi-assets-s-public-workspace/environment/19650166-866da684-1c98-492c-a9e9-6ed287c28746 containing working credentials for asset assets-paris-demo.codefi.network. We would like to thank @polem4rch for their work!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.