‹ BackHN Continuity

Thread

Sourcehut account takeover via build logs (XSS in ansi2html)

153 points · 29 comments · arusekk

  1. kgraves · · focus · HN ↗
    Congrats on the write up, seems extremely serious, I hope Sourcehut and Drew paid you well for this.
    1. arusekk · · focus · HN ↗
      I hope they will one day. I said I'm fine with verbal credit if they don't have money, so I won't nag them unless I end up finding more.
      1. spyc · · focus · HN ↗
        A free-for-life &quot;Professional hackers&quot; package (<a href="https:&#x2F;&#x2F;sourcehut.org&#x2F;pricing&#x2F;" rel="nofollow">https:&#x2F;&#x2F;sourcehut.org&#x2F;pricing&#x2F;) would be the minimum compensation in my eyes.
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.