If you reported them, chances are, the business would be shut down.
[0] https://www.rba.gov.au/payments-and-infrastructure/payments-...
Pine Gap is the world’s largest network tap, after all, invalidating the human rights of close to 2 billion people, every single second of the day.
The nation was bred to be so compliant. Australians are not afraid of licking boots if it means cheap avocados can be smashed.
I used a freshly generated virtual credit card with payment amount +20$ as a limit (just to be sure).
I swear half my job these days is helping australian businesses retroactively purge themselves of plaintext card data.
I have seen some shit man.
Nice work on finding it :)
If this really was the first api request made by the app, and it has a serious vulnerability, then the omens are not great for the rest of the api calls either.
Looks like he did some research before.
On the other hand
>On day 2 I awoke and began by finding some form of contact details, information was somewhat sparse but I managed to find a phone number.
Doesn't a responsible disclosure policy contain contact infos on where to report usually?
When it comes to random companies running their own VDP vs. hiring it out, it can be less than standard despite there being lots of resources on setting it up. I've seen ones that only include a phone number, the email address listed doesn't exist anymore, etc.
Others have had to even get to the point of contacting an executive via LinkedIn despite there being a VDP page / security.txt.
> I did some research and found that the app did infact have a responsible disclosure policy which at that point, I was happy to continue forth.
I would not be so confident in stating that they did not break the law.
