Summary When testing for vulnerabilities in Zoom’s new Zoom Mail and Calendar feature, we identified a vulnerability that allowed us to claim a “system” email belonging to Zoom. Claiming this emai...

Summary During the recent Ambassador World Cup held by HackerOne, we identified an account takeover vulnerability in Shopify affecting a subset of Shopify’s Shop users. A successful exploit would h...

This blog post is authored by Rojan (@uraniumhacker) and Tanner (@itscachemoney). Summary Anti-phishing tools and products are used widely at various enterprises to prevent malicious emails from ...

Summary We identified that several companies were creating custom support portals on top of common support systems like Zendesk. In doing so, companies created misconfigured API integration allowi...

Summary We identified a security issue in GitHub’s Repository Security Advisory feature (https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/about-repositor...