Gratipay · Report #154921
Content Spoofing/Text Injection
Validstatus
lowseverity
$1bounty
5upvotes
7 Aug 2016disclosed
Summary
Researcher @ahsantahir reported a content spoofing on the search functionality. The search query was displayed in the page, but without any prefix. We added "Results for:", so nobody can be misinformed.
This has been fixed in the last version and the fix is now deployed.
Thanks for making Gratipay a safer place!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.