Trying to get in touch regarding a security issue about html-minifier-terser HOT 4 CLOSED

Hi @zidingz,

please send me the details to [email protected]. Also there is my email address in every commit message.

from html-minifier-terser.

I think there went something terribly wrong with huntr:

I've got 6 emails, 4 of them with the same subject line:

[ Cross-Site Request Forgery (CSRF) ] New Security Issue in cachet

[ Unimplemented or Unsupported Feature in UI ] New Security Issue in cachet

[ Insufficient Documentation of Error Handling Techniques ] New Security Issue in cachet

[ Insufficient Documentation of Error Handling Techniques ] New Security Issue in cachet

[ Insufficient Documentation of Error Handling Techniques ] New Security Issue in cachet

[ Insufficient Documentation of Error Handling Techniques ] New Security Issue in cachet

Totally different project and it seems you reported these things to a fork of the original project, which makes not that much sense. And most of them are duplicates.

Also leaking details regarding other unrelated projects is not great either:

Sending details to the wrong persons is critical. Please check this with your team before sending any emails and better remove this "other advisories" part on the right side which leaks details regarding different projects. It seems your team and project lack some good security practices in general @JamieSlome

from html-minifier-terser.

@DanielRuf - thanks for your comments and for sharing this with us.

With regards to the e-mails, I apologise that these were sent over to you. We have identified the cause and will be reviewing this tomorrow to ensure it doesn't happen again.

The links provided for other projects on reports are only visible if the vulnerability has been patched, and so no details are being leaked cross-projects.

Nonetheless, I will review your comments with the team and thank you for your patience! 🍰

from html-minifier-terser.

@DanielRuf So sorry for this! We've identified the cause and remedied the permissions.

I've just sent you the correct email regarding the issue in html-minifier-terser.

Thank you so much for bringing attention to our error; it's of utmost importance that we take extra care in future.

from html-minifier-terser.