Mozilla · Report #2030076
Mozilla FuzzManager API Token Exposed in Git Commit
Validstatus
criticalseverity
49upvotes
29 Nov 2023disclosed
Summary
The researcher has discovered that an API token for the FuzzManager of Mozilla (https://fuzzmanager.fuzzing.mozilla.org) was leaked in one of our GitHub repositories. The API token provides access to our internal fuzzing data and results. The token was accidentally configured with read-write access, we rotated the tokens and made sure to use write-only tokens in our workers
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.