Average Conversation between Security Researcher and YCombinator Startup CEO
Source Reddit Cybersecurity
Discussion
A security researcher discovered an authentication bypass vulnerability in a YCombinator startup's platform that allowed unauthorized access to patient information, including personally identifiable information (PII) and protected health information (PHI). The vulnerability exposed API keys and tenant data behind an authentication guard. Attempts to responsibly disclose the issue to the startup's CEO were met with dismissal and blocking of the researcher. No patch or remediation information is provided.
r/cybersecurity (opens in a new tab)u/m-a-wanderer0 points0 comments
Researcher: ...Using the API key, anyone is able to find information of the patients that includes their PII and PHI
CEO: are you dumb?
Researcher: What?
Blocked
Proof:
Background: Found an authentication bypass on their platform which was behind auth guard, revealing information on all their tenants, along with the API keys. Excerpt above is the part of the real conversation when tried to bring the issue forward to the CEO.
Posted on YCombinator subreddit as well.