Given there's an internal API for a URL, how can you make it return client_secret and server token (possibly other sensitive info)?

This question is influenced by a bug report filed on hackerone.com https://hackerone.com/reports/419655

I'd like to understand how this vulnerability could be find.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.