HexBrain

Legal Robot · Report #251526

No notification on change password feature

Validstatus
8upvotes
30 Jul 2017disclosed

Summary

A security researcher discovered that Legal Robot did not send notifications on important account changes, like password changes. While there was no specific security vulnerability, we decided to add notifications for Password Change, TOTP Enable/Disable, U2F Enable/Disable, Recovery Code Use, and Recovery Code Confirmation (recently reported in #250082).

i discovered that there is no notification at some account actiivity. after discussing with @danrubins , he comes with more point to notify user on many activity (U2F Enable/Disable Recovery Code Use etc. ) Thanks a lot legal robot team and @danrubins .

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original