marcuzhn

FYI the fix has been deployed (and it was unrelated to what I've said in my first comment). Thank you very much for helping even though it didn't start the right way!

Yes, the fix has been deployed 20 minutes ago.

I am not sure why all this hate, as I said we fucked up the way the initial ticket has been handled and it's sorted now. :P FYI we plan to release the fix shortly and sebiw has already been rewarded via our official bug bounty program.

LOL I expected that. Simple reason: we have received a good number of reports for our dashboard and some of them are still open mostly because they are not top priority. Needless to say we accept all reports and reward them accordingly to severity. :)

I am not 100% sure about the legal details, but Nexmo as a company has a bug bounty reward program, so I assume in our case it doesn't apply because we want to know what's wrong and we request responsible disclosure (usually after the fix is in production). You can see it here: https://cobalt.io/nexmo (yes, it isn't yet linked from our www).

Totally agree and it's in the plan to add the security page (I don't have an ETA honestly). I will add you to our program shortly, thanks!

I'm Marco and I work in the ops team at Nexmo. I have found your initial email to our Support team, and I can see that there have been some changes in our dashboard related to your report. I am not sure it's fixed because I don't have the details about the vulnerability you discovered, but I do know that initially we were resetting the user password straight away after a request. This is no longer the case - the email address now receives a reset link. If your report is still relevant despite this new procedure, I am very happy to receive the details.

Also, I would like to respond to the complaints that "we don't care about security". This is simply not true and we even use a bug bounty reward program. We do care and we accept reports through https://cobalt.io/ (ex CrowdCurity), so if you share with us your username/email on cobalt, we can add you to our program.

I totally agree we fucked up handling your report better back in may. I hope you are still willing to work with us!