Instacart · Report #160120
API OAuth Public Key disclosure in mobile app
Informativestatus
5upvotes
15 Sept 2016disclosed
Summary
Our Android/iOS app can be decompiled and the OAuth Public token can be accessed.
Contrary to Instacart's summary, the API private key is also leaked, allowing anyone to use Instacart's private API without restriction. Instacart (which I have found to be great in general) ignored my additional feedback and changed the report title to make it seem less of an issue.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.