The byline says “security researcher”, but I didn’t find any mention of disclosure to the platform security team in the blog post. What gives?
The companion blog post from Sam Curry says the issues were reported and fixed within hours.
The authors do this kind of stunt hacking all the time, they look at shit that has no security contact, no bugbounty, and they hack them without permission for clout