Security Hall of Fame

Responsible disclosure of unvalidated X-Forwarded-For request header handling on the registration endpoint that allowed bypassing sliding-window IP rate limiting.

Responsible disclosure of missing velocity limits on public registration, leading to the deployment of sliding-window IP rate limiting (HTTP 429).

Responsible disclosure of sub-addressing (+ tags) on non-Gmail mailboxes in the registration flow that bypassed canonical mailbox normalization.

Responsible disclosure of missing server-side session revocation upon logout allowing previously captured access tokens to remain valid and replayable.

Responsible disclosure of a parser normalization bypass on authentication routes allowing external protocol-relative redirection.

Responsible disclosure of case-insensitive token comparison allowing password reset and email verification tokens with modified character casing to be accepted.

Responsible disclosure of unintended client-side transmission and local persistence of user RSS syndication tokens within third-party analytics telemetry.

Responsible disclosure of a weak password validation policy allowing users to register or reset account credentials using their email address or username.

Responsible disclosure of a concurrency race condition in the audio generation endpoint that allowed bypassing monthly studio audio limits via parallel requests.

Responsible disclosure of authorization code reuse on the Google OAuth callback endpoint that allowed re-establishing an authenticated session after logout.

Responsible disclosure of unvalidated GET request handling on the logout endpoint that allowed cross-site forced session termination.

Responsible disclosure of broken access control where deleted podcast episodes remained accessible via direct ID lookups and were resurrected into public access due to disk fallback heuristics.

Responsible disclosure regarding weak password complexity enforcement and input length boundaries on registration and password management.

Responsible disclosure of unvalidated next query parameter causing client-side redirection on the email verification required page.

Responsible disclosure of OAuth login CSRF risk from missing state validation and untrusted redirect URI handling.

Responsible disclosure of observable response differences that exposed account existence and email verification state.

Responsible disclosure of insufficient session expiration where previously issued JWTs remained valid after password rotation.

Responsible disclosure of sensitive authentication token exposure in an authenticated account preferences response.