I was doing some discover content on a website of a bug bounty program and realized that i got some 200 codes on directory that are Forbidden when trying to access to them throw the browser. i am able to read these forbidden contents but they don't have any sensitive/critical information.

Most of them are JSON files and others are just have HTML. my doubt here is, why do they have them forbidden is there is no critical information, am i missing something from here that i shouldn't?

I'll show a 200 response that i got that is forbidden throw the browser..

  1. example:

{"id":5,"currency":"GVP","iso_code":"GB","en_name":"United Kingdom","native_name":"United Kingdom","is_active":true,"regions":[]}

  1. example:


  • 2
    I have to say, an otpToken does sound sensitive just a little bit... – Peter Harmann May 25 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.