Go ahead, change that number in the URL of that service that you use

Last month, I learned that it’s apparently not common behavior in computer users to start fiddling with the URL of a link that they receive, just to see what happens. “It wouldn’t even come to my mind to do that!” was one reaction. And that’s how I ended up discovering a vulnerability on a service that I personally used. Unlike most security vulnerabilities that get reported nowadays, it didn’t take me a fleet of token-thirsty LLM-based agents to get the job done. I just noticed that the e-mail with my order had a number in it, it served as a share code, and then I began iterating it a few times to see what happens. Plain old human curiosity. Then a few numbers later I stumbled upon someone else’s account. I let the company know about the issue politely and with detail and potential mitigations, and after a week of back-and-forth, they actually implemented the fixes that ensure that both old orders and any future ones are now appropriately handled, minimizing the risk of a data leak…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town