<html><body><div><div><span>I had a situation like that a few years ago.</span></div><br><div><span>Someone accidentally included the .git directory in a docker image that was deployed to a customer's website.</span></div><div><span>Unfortunately early checkins of the .git directory included a copy of the WordPress (yuck!) config file with hard-coded passwords. Those were moved to environment variables, but never changed. And for some reason the "developer" left indexing turned on. So the person was able to download the git directory and walk back through the history and found the passwords....and then connected to the database which had some mild PHI (first names and phone numbers).</span></div><br><div><span>Since the tech contact for the domain came back to my company and not the developer, they reached out to me. After a few pleasant emails back and forth he told me exactly where he found the passwords. I rotated passwords and yelled at the developer, and thanked the guy who found it. He kindly asked if I would "donate" to him by buying something from his Amazon wishlist. I should note that he asked </span><i><span>after</span></i><span> he told us exactly what the problem was.</span></div><br><div><span>I discussed it with the client and they picked some ~$400 item from the list and sent it to him.</span></div><br><div><span>It could have been worse, but everyone involved agreed that it would be nice to reward the guy for pointing out the blunder.</span></div><br><div><span>$400 was a small price to pay for the client since they do something like $10 million USD per month. After that the client paid for a full security audit of their web presence by a 3rd party company and everything came back clean.</span></div><br><div><span>Do what you think is appropriate, but I'm all for encouraging responsible and positive disclosure as well as being kind. If the guy had started the email with "send me money or else I'll disclose" the entire process would have been very different.</span></div><br><div><span>-A</span></div></div><br><div><div>On Wed Mar 2, 2022, 10:30 PM GMT, <a href="mailto:bruns@2mbit.com">Brie</a> wrote:<br></div><blockquote style="margin:0 0 0 4pt;padding-left:4pt;border-left:1px solid lightgray"><div style="color:#212121;font-size:14px;font-weight:normal;line-height:20px">I just got this in my e-mail...<br><br>------<br>From: xxxxxxx <<a href="mailto:xxxxxxxxxx6@iqra.edu.pk">xxxxxxxxxx6@iqra.edu.pk</a>><br>Date: Thu, 3 Mar 2022 03:14:03 +0500<br>Message-ID: <<a href="mailto:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@mail.gmail.com">xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@mail.gmail.com</a>><br>Subject: Found Security Vulnerability<br>To: undisclosed-recipients:;<br>Bcc: <a href="mailto:sxxxxxxxxx@ahbl.org">sxxxxxxxxx@ahbl.org</a><br><br>Hi Team<br><br>I am a web app security hunter. I spent some time on your website and found<br>some vulnerabilities. I see on your website you take security very<br>passionately.<br><br> Tell me will you give me rewards for my finding and responsible<br>disclosure? if Yes, So tell me where I send those vulnerability reports?<br>share email address.<br><br>Thank you<br><br>Good day, I truly hope it treats you awesomely on your side of the screen :)<br><br>xxxxx Security<br>------<br><br><br>Is soliciting for money/rewards when the site makes no indication they <br>offer them a common thing now?<br><br>If you want to see a copy of the original message, let me know off list <br>and I'll send it to you.<br><br><br>-- <br>Brielle Bruns<br>The Summit Open Source Development Group<br><a href="http://www.sosdg.org">http://www.sosdg.org</a> / <a href="http://www.ahbl.org">http://www.ahbl.org</a><br></div></blockquote></div></body></html>