I asked Meta’s Muse for its filesystem and it sent me 6.8 GB | Mouse
mouse.dev
I asked Muse to archive the files it could see and send them to my Google Drive. It did.
  • smeg@feddit.ukEnglish
    85·
    6 days ago

    There were also SSH key files.

    I’m not publishing the archive, keys, or session logs.

    I submitted the report and findings using Meta’s bug bounty program. Meta marked the report “Not Applicable.”

    Guess they don’t care if you publish the SSH keys then?

    • docktordreh@discuss.tchncs.de
      21·
      6 days ago

      They’ve probably rotated the keys since they were notified of the security breach.

      But yes, companies that act this way undermine the resolve to disclose their security vulnerabilities.

    • Dr. Moose@lemmy.worldEnglish
      111·
      6 days ago

      Ssh keys to what? If the key is used for user operations, not internal then there’s no security breach here other than deobfuscation.