On: Researcher finds flaw in a16z website that exposed some company data

[xyst]

When I create a new service and add LetsEncrypt cert to server via ACME. I immediately see logs filled with junk, obviously bots searching for shitty defaults that devs might leave open. I have even seen requests for the process env file lol.

How was such vuln not found and abused in this case? a16z is very lucky or maybe it was abused and not disclosed. Researcher or bored person with a kind heart/white hat hacker mindset is the first to reach out.

a16z should be fined heavily unfortunately there is no legal framework for this type of negligence

[Quarrel → xyst]

> How was such vuln not found and abused in this case?

Maybe it was..

There might have been more value in leaving this one open than just screwing with them.

[wouldbecouldbe → xyst]

To be fair, their main site doesn't seem super interesting. Couple of those credentials, such as OKTA seem bad though.