hackermondev

the fact they're not even trying to hide this is beyond crazy

> openai-watchlistdb.withpersona.com

> openai-watchlistdb-testing.withpersona.com

Discord puts the authentication token in local storage

the impact varied by customer. in Discord's case, the auth token is stored in local storage and their docs is hosted on the primary domain; they were susceptible to a full account takeover. X's docs are on a different subdomain but we found a CSRF attack that could facilitate a full account takeover. most companies were significantly affected in one way or another.

imo, the impact is pretty clear here. an unsuspecting user clicks (or is redirected) to one of these malicious links on the platform (ex. vercel); the script grabs their cookie and credentials and sends it to the attacker. they now have full access to the victim's account.

Thanks for the feedback, I've updated the README!

That's what the `window` option does (https://github.com/hackermondev/batched?tab=readme-ov-file#b...). After the first item is added to the buffer, it waits for the maximum window time, then calls the inner function with the buffer fill.

Need to be specified at build time, but you can set a dynamic window length based on the current buffer length. https://github.com/hackermondev/batched?tab=readme-ov-file#b...

seriously doubt Google Cloud is relying on Cloudflare KV lol

that's a hackerone bug, that 8-year-old report is not mine :)

replit better

Not enabled for me, do I have to change a certain setting?