AI want to scatter my brain but as omo ogbon, I catch am π
I still dey talk am, always review before you accept code changes else you go just dey get redundant code whenever you request changes.
Should I take a step to report or I mind my business but I'm not comfortable with my profile being exposed. Last two weeks, I received a call from someone claiming to be the staff of that programme requesting for my password before she can fix my issue. Wth do you need my account password to fix an issue assuming you are not impersonating a staff? I didn't release it tho, the next thing she started saying stuffs related to threats/urgency. I sent a message to the programme team lead, after the back and forth, it was discovered that such person didn't exist because I requested her name. Imagine, how many people that might fall into the scam.
Some confidential data are just exposed unnecessarily π€¦π€¦π€¦
I was checking through the endpoints of a particular programme to figure out an error I have been experiencing for the past four weeks, which I had already reported but received no response. So, I decided to explore the endpoint responses and review each endpoint across different pages.
As someone who has taken courses in cybersecurity, watched several videos, and has a strong interest in the field, I always keep security in mind when building applications. I decided to test something I learned in one of my courses, known as a Broken Object Level Authorization vulnerability.
I used the token of an already logged-in user to access other usersβ data simply by modifying the ID. I tested this on an endpoint, and it worked. In the first instance, there was sensitive and unnecessary data being returned in the endpoint response data that was not required for that page. This exposed user information that could potentially be used for impersonation, which clearly violates the principle of least privilege.
There are many more issues I would like to mention about the programme, but I am concerned about possible consequences. I want to make a proper report, but since they didnβt even respond to the frontend issues I initially reported, Iβm worried they might misunderstand my intentions and assume I am trying to hack the portal.
What do you think I should do?
Note: This is a government-created programme. I strongly believe backend developers should always prioritize security above all else.
@4osp3l@ireteeh@commando_skiipz@segoslavia
True, it does the changes automatically before you can even review except I'm missing something. You can only review or see the code diff after the changes have been made unlike GitHub Copilot, you see the changes and review at the same time before accepting it.
Lost 2 hackathons in a row
Still sourcing for more, I hope to win one one day. I learned a lot when working on the Hackathon project tho.
Till then, we keep building. βοΈ