Readit News"Security through obscurity" isn't really good enough.
The first was that 123456 was the credentials for the admin panel.
The second was an insecure direct object reference, where the lead_id querystring parameter can be changed on an API call to retrieve another applicant's data.
Deleted Comment
Thankfully, I can be patient, but I wonder sometimes if some of these companies will ever exit.
As an LP, I would be excited for liquidity in 10 years at this point.
It seems like even for successful companies, there isn't a clear path to an exit for many of them. Add to that the increase in late-stage investors, and there isn't much of an incentive to exit.
This "gotcha game" has become so tiresome.
This is every day for a developer though.
The pay will probably be less, but it is a trade-off.
Regardless of what you think of Jon Pretty, how is this justifiable? Telling people they can't unsupport something because you're not open to issues, but also not removing it?!
Yes.
I have no involvement in this drama (it's the first I've heard of it actually), but signing your name to something matters.
Choose carefully what/who you support.
A repo owner is not obligated to accept contributions.
All of those people are free to create their own repo, post on social media, or write an article recanting their support if they choose to do so.