Darpan Neve @darpanneve - Twitter Profile

Here is a public statement from @Wahidkhan7852 , who's done an excellent job at exposing the vulnerabilities of the Scam called GirlScript Summer of Code - my co-researcher Vishisht Mishra and I spent the last week conducting a responsible security disclosure on GirlScript Foundation's GirlScript Summer of Code platform. approximately 1,70,000 individuals had their personal data exposed - students, mentors, and applicants spanning 2020 to 2026, across 57 countries. the exposure included names, email addresses, dates of birth, phone numbers, resume URLs, and other sensitive fields. 883 confirmed accounts belonged to minors. none of this required any attack, any exploit, or any technical sophistication to access. the data was publicly accessible. we followed CERT-In's responsible disclosure guidelines. we prepared a comprehensive report covering every finding, a full remediation roadmap, and the applicable legal obligations under the DPDP Act 2023, the IT Act, and relevant international frameworks. the full report was shared before we received a single rupee. their response was to place our disclosure communications on record with the Office of the Commissioner of Police, Pune, and the Cyber Crime Cell, Pune. we have since filed independently with CERT-In (Ref: CERTIn-97826626), notified MeitY for onward transmission to the Data Protection Board of India, and filed a preemptive statement of facts directly with Pune Cyber Cell and the Commissioner of Police, Pune. the fee we requested was explicitly non-compulsory and was never paid before the full report was shared. a fee request that carries no condition, attached to a report delivered freely in advance, is not extortion under any law. referring researchers to law enforcement for this, rather than addressing a breach of this scale, has a chilling effect on the entire research community. the next researcher who finds something like this might just walk away. that outcome is worse for everyone. the 72-hour notification window under Section 8(6) of the DPDP Act 2023 has elapsed. as of our last correspondence, GirlScript Foundation had not indicated any intention to self-report to the Data Protection Board. if you participated in GSSoC between 2020 and 2026, your data may have been part of this exposure. a sanitised technical advisory will be published shortly in accordance with our stated disclosure timeline. #responsibledisclosure #cybersecurity #dpdpa #infosec #bugbounty

7

64

3

17

4K

0

25