$3k Bug Bounty – Twitter's OAuth Mistakes

Yeah I've seen a few patterns with the worse companies...

  * "We've already fixed it" (we haven't but we don't want to pay up, and a fix mysteriously appears a month or three later)
  * "This is not eligible" (we don't actually care)
  * Silence
  * Legal threats ("send us your address so we can send you something for this", and a C&D turns up)

I submitted a similar bug to the OP after someone bragged about reading my DMs (and sent a bunch of them to me as proof). Spent what must have been a month poking at the website and API, looking at various attack vectors. Eventually I boiled it down to a simple POC which ran perfectly on my account and a second account I created for the purpose. A friend volunteered, worked on their account too.

Did a full report including POC and quick summary. First line was something to the effect of "I'm not interested in the bug bounty, I just want to see this fixed. If a BB is awarded, I'd like to see it donated to charity." (I had a few in mind, mostly local LGBTQ+ support charities)

Response I got was "This isn't OWASP TOP10 fuck off". Literally just that (I'm looking at the emails).

Scanned the OWASP guidelines, found one it hit, replied. "Are you sure it's not covered by (x)? Seems like it would be to me. At the very least it's an exposure of private data."

Response: "I told you already to F off, noob."

I replied: "Can you please at least clarify why this isn't covered? I'd like to submit better reports in future."

No response, and I dropped it at that point. Two days later someone else in Twitter responds: "I'm the manager of Engineer'sName, the conduct in this report horrifies me. Expect to hear from us."

A bit later I got an email from HackerOne explaining I'd been banned, and that if I created another account I'd be hearing from their lawyers.

And that's how my first and last security vuln submission ended.