Hacker News Reader

About a month ago I noticed that my bank had a vulnerability - I could access the details and photos of every remotely deposited check. I sent them an email, they took the feature offline in about 2 hours.

No bug bounty but oh well.

View on HN

My bank used to show deposited check photos in a popup with the URL viewable iirc, and sometime they switched to a modal window with base64 data as the source instead of a URL that might be manipulated. I wonder how many small banks still may have bugs like that

Modifying a data: url is a feature not a bug.

which bank?

It was a credit union, not one of the massive ones, but beyond that I'd rather not say.

Reply on news.ycombinator.com