Mapbox · Report #222724
Open Aws Amazon S3 Buckets
Validstatus
mediumseverity
$500bounty
39upvotes
25 Apr 2017disclosed
Summary
Security researcher @saad_ahmed reported two Mapbox owned S3 buckets with public-read ACL. One of these, mapbox-js, was public-read by design, the other however was not and subsequently was switched to a private ACL. Thank you again @saad_ahmed, we appreciate you keeping Mapbox security in mind.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.