I have one thing to say. – DEJAN

We went back and forth a couple of times as they weren’t thorough enough, for example they’d left the elixir repo exposed after patching php and java, but it all got sanitised in the end and I was given credit and a $5,000 reward for the report, the amount I laughed at and had the opportunity to re-negotiate (it’s literally a button you press if you’re not happy with the bounty) but decided to stay focused and grateful that my main objective was accomplished. The repos were fixed.

Well almost, the cached hexadocs stuff was still there and despite the capacity to cause harm Google refused to de-index on ethical grounds quoting that they hold themselves to the same standards and rules as everyone else.

They were worried though.

KO…@GOOGLE.COM 22.05.2024 | 01:10 | #11

Hey Dan, I have a quick question:

Do you have plans to disclose the issue publicly, and, if so, would you mind notifying us ahead of time with the details you want to share (anything is helpful, like the fact that you plan to disclose, a potential ****, a writeup draft etc.). The decision to disclose is fully yours in our programs, but any heads up helps us coordinate things internally.

Congrats on the reward again!

And my reply:

[email protected] 22.05.2024 | 06:07 | #12

My personal policy on the matter is as follows:

1. Open about what I found, the fact I reported it and that it was
patched up.
2. No plans of disclosing specifics to the public (e.g. naming systems,
modules or attributes, detailed write-up, blog post, talking to media etc)

You mentioned giving you a heads up in case I plan to disclose things (I
don’t) but I don’t know who my contact is as you system anonymises the
emails.

Some clarity would be good.

For example, would you prefer I don’t even mention the nature of my find?
There’s an obscure and unpublicised line about it on my profile page.
What if it comes up in a conversation or as a question while I’m at stage
during a conference talk?

Generally, happy to make things easy for you, just let me know.

More importantly you should probably take care of the repo version
reference:

–
https://hexdocs.pm/google_api_content_warehouse/0.4.0/api-reference.html
–
https://hexdocs.pm/google_api_content_warehouse/0.3.0/api-reference.html
–
https://hexdocs.pm/google_api_content_warehouse/0.2.0/api-reference.html

(or at least remove it from search results
<https://www.google.com.au/search?q=%22Represents+a+subpart+of+the+anchor+data+of+the+docjoins%22>
)

*Dan Petrovic*
Director
Phone: 1300 123 736