HexBrain

WakaTime · Report #245311

Missing Account Deletion Notification

Validstatus
5upvotes
3 Jul 2017disclosed

How it was found

Currently, there is no email notification sent out when the account was deleted.

I understand it asks for the password to delete but when an attacker somehow get's the credentials, he can only 'read' users data without alarming the user. It would stop him if he knows the user would come to know immediately when all the data was deleted.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original