Ashish Pathak Sec

Firefish Bug Bounty Scam

As an independent security researcher, I believe in responsible disclosure and helping organizations improve their security posture. This post documents my experience reporting multiple security issues to Firefish and the events that followed.<h2>The Reports</h2>Over time, I identified and responsibly disclosed multiple security-related findings affecting Firefish. These included:<ul data-spread="false"><li>Content Spoofing via Email Parameter</li><li>Missing Rate Limiting on Admin Login</li><li>Deprecated TLS 1.0 Supported</li><li>Missing Rate Limiting on Sign-Up Enables Mail Bombing</li><li>Missing X-Content-Type-Options Header</li><li>Missing HTTP Strict Transport Security (HSTS)</li><li>SPF Softfail (~all) Allows Email Spoofing</li><li>Weak DMARC Policy (p=quarantine Instead of p=reject)</li><li>Password History Reuse Allowed (Missing Password History Enforcement)</li><li>Server-Side Denial of Service via Unrestricted Password Length</li><li>Missing Content Security Policy (CSP) Header</li><li>Missing Self-XSS Protection</li></ul>Each report was documented and submitted through the appropriate channels following responsible disclosure practices.<h2>Payment Discussions</h2>After the reports were submitted, I was informed that a reward would be processed within one week. When that deadline passed, I was told the payment would be made the following week instead.During the process, I was asked to provide a complete list of all the issues I had identified so they could be evaluated together. I complied and submitted all of the findings.However, after the review process, all reports were ultimately classified as informational or otherwise ineligible for a bounty reward. Instead, I was offered a goodwill payment of 100 EUR. <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNfv46VVWBzV-tBeRYu-lY0Ba0_YoFKQhPoj6aUs4QogNU1ewjoJvto2D5Na4sMWcZFSLmLjed6_L0Ll_cr89wx4MTkCqRVb-7J4uGrngRgKaOn5OGes2Kh41Eg75ebbblGEDin4d3mzHhxWo_5crVJg2H-zReyLlCaigkn9JsGQ3LzUAVc19hA4cBEnM/s726/ffffffffffffffffffff.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="488" data-original-width="726" height="415" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNfv46VVWBzV-tBeRYu-lY0Ba0_YoFKQhPoj6aUs4QogNU1ewjoJvto2D5Na4sMWcZFSLmLjed6_L0Ll_cr89wx4MTkCqRVb-7J4uGrngRgKaOn5OGes2Kh41Eg75ebbblGEDin4d3mzHhxWo_5crVJg2H-zReyLlCaigkn9JsGQ3LzUAVc19hA4cBEnM/w618-h415/ffffffffffffffffffff.png" width="618" /></a></div>  Email : gorrdy@firefish.io<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCS_JJhoy1_rtJ3eDHL1SmubfTxLEte3dCmuD3BW9C7YT2Ymdvask_3dGGd-JWpIYz8hHBwiq7dwIkJ_JBHb3Q5VPIxH4LM5IlMaVPyQWK318Vv9i73X63l7Z6CWM8uuexogTVFjkhKeMdpp0LyXxZgNUZqXHES0203X6li83ngTI0_wG4GGYL8RkT214/s200/1774168949813.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="200" data-original-width="200" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCS_JJhoy1_rtJ3eDHL1SmubfTxLEte3dCmuD3BW9C7YT2Ymdvask_3dGGd-JWpIYz8hHBwiq7dwIkJ_JBHb3Q5VPIxH4LM5IlMaVPyQWK318Vv9i73X63l7Z6CWM8uuexogTVFjkhKeMdpp0LyXxZgNUZqXHES0203X6li83ngTI0_wG4GGYL8RkT214/s1600/1774168949813.jpg" width="200" /></a></div>  <h2>My Concerns</h2>Based on the scope and severity of the reported issues, as well as the time invested in identifying, validating, documenting, and responsibly disclosing them, I was disappointed with the outcome.My primary concern is not only the reward amount but also the process itself. Payment discussions took place, timelines were provided, and additional information was requested before the final decision was communicated. The delays and lack of clear communication made the experience frustrating.<h2>Why Transparency Matters</h2>Bug bounty and vulnerability disclosure programs rely on trust between researchers and organizations. Researchers invest their time and expertise to help companies identify and fix security weaknesses before they can be abused.Clear communication, transparent evaluation criteria, and timely responses are essential to maintaining that trust.<h2>Final Thoughts</h2>This article reflects my personal experience with Firefish's vulnerability disclosure process. I remain committed to responsible disclosure and security research, but I also believe researchers should be able to share their experiences openly and factually.<h2>Additional Findings</h2>Following the outcome of this process, I decided not to continue reporting additional issues that I identified during my research.At the time, I had reason to believe there were further vulnerabilities that warranted investigation, including a potential SQL injection issue. However, given my experience with the review and reward process, I chose not to invest additional time in preparing and submitting further reports.I believe responsible disclosure works best when there is mutual trust, transparent communication, and fair treatment of researchers. Unfortunately, my experience in this case left me unwilling to continue dedicating further research efforts to the platform.

Firefish Bug Bounty Scam

As an independent security researcher, I believe in responsible disclosure and helping organizations improve their security posture. This ...

( PAID CASE SOLVED CHECK COMMENT ) Scam With Security Researcher Luis Carchi Scammer Of GetShield.xyz

A security vulnerability report should end with acknowledgment, 
communication, and fair handling. Unfortunately, my experience with 
GetShield.xyz has been the opposite.I am publishing this post to 
document my experience after responsibly reporting a vulnerability that 
was reviewed and acknowledged by the company.<h2>Company Information</h2>The company publicly identifies itself as GetShield and operates through GetShield.xyz.Relevant public profiles:<ul><li>Company Website: <a data-saferedirecturl="https://www.google.com/url?q=https://getshield.xyz&source=gmail&ust=1780432773853000&usg=AOvVaw0mbXVKeN5-HjJOJ3FneFZ8" href="https://getshield.xyz" target="_blank">https://getshield.xyz</a></li></ul><div>
According to public company information, Luis Carchi is listed as the CTO and Co-Founder of Shield.

</div><ul><li>Luis Carchi Personal Website: <a data-saferedirecturl="https://www.google.com/url?q=https://www.luiscarchi.com&source=gmail&ust=1780432773853000&usg=AOvVaw2oP8dUah0ocaytg8Qr97JE" href="https://www.luiscarchi.com" target="_blank">https://www.luiscarchi.com</a></li><li>Luis Carchi LinkedIn: <a data-saferedirecturl="https://www.google.com/url?q=https://www.linkedin.com/in/carchi-luis/&source=gmail&ust=1780432773853000&usg=AOvVaw22vn1JXfzM5NwcVFXyOWaR" href="https://www.linkedin.com/in/carchi-luis/" target="_blank">https://www.linkedin.com/in/carchi-luis/</a> <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi43tbl57dwQUruGN8JYij1VdhYInzh7oZFH8eI61adtOyFtmKzTmKVto7mOaLwFj_iaEzz4iPq3biXH1Ofa3RyE8Af6oMcA13FGe6-DUvR2MH3NLPfqiojByR8EEuR_hVcdeOiKRLyfqGzUd7ZVm_i4-V-6DGEV6p5VpkE5IrmvR6pFW6MH1VxisfBtpk/s224/images.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="224" data-original-width="224" height="312" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi43tbl57dwQUruGN8JYij1VdhYInzh7oZFH8eI61adtOyFtmKzTmKVto7mOaLwFj_iaEzz4iPq3biXH1Ofa3RyE8Af6oMcA13FGe6-DUvR2MH3NLPfqiojByR8EEuR_hVcdeOiKRLyfqGzUd7ZVm_i4-V-6DGEV6p5VpkE5IrmvR6pFW6MH1VxisfBtpk/w312-h312/images.jpg" width="312" /></a></div>   <div class="separator" style="clear: both; text-align: center;"><iframe allowfullscreen="allowfullscreen" class="b-hbp-video b-uploaded" frameborder="0" height="566" id="BLOGGER-video-3fea2d0904063730-8680" mozallowfullscreen="mozallowfullscreen" src="https://www.blogger.com/video.g?token=AD6v5dwSOyMyo9ZkESo1R6ekUS88j08dHWnlsrcoPvOziRIpOb7nx-TfBYux48vRn9LEAoeFtHVJyzwLyCMLRDISpRtIpJPkv3kHJe4x3RFmVEGXZchpzMX5xeSWEc7CcsidKEmXwrM&origin=ashishpathaksec.blogspot.com" webkitallowfullscreen="webkitallowfullscreen" width="680"></iframe></div>  </li></ul><h2>Vulnerability Disclosure</h2>I discovered and responsibly reported a security issue affecting the platform.After
 reviewing the report, the issue was acknowledged and I was informed 
that a reward of 100 USDT would be provided for the finding from luis.Following their instructions, I submitted my wallet address for payment.<h2>What Happened Next</h2>After providing the payment address:<ul><li>Communication became extremely limited.</li><li>Multiple follow-up emails were sent.</li><li>More than 10 days passed without payment.</li><li>No clear explanation was provided regarding the delay.</li><li>Warning emails requesting clarification were ignored.</li></ul>At the time of writing this post, I have not received the promised 100 USDT reward.<h2>Why This Matters</h2>Security
 researchers spend time identifying vulnerabilities and reporting them 
privately so organizations can fix issues before they are abused.When
 companies acknowledge reports and discuss rewards, researchers expect 
transparent communication regarding payment status and timelines.The facts are:<ul><li>A vulnerability was reported.</li><li>The report was acknowledged.</li><li>A reward of 100 USDT was discussed.</li><li>My payment address was provided.</li><li>More than 10 days have passed.</li><li>Repeated follow-up emails have not resulted in payment or a meaningful response.</li></ul>Readers can form their own conclusions based on this timeline.<h2>Request For Resolution</h2>I would still prefer to resolve this matter privately and professionally.Luis
 Carchi responds, provides clarification, or completes the promised 
payment, I will update this post to reflect that outcome.Transparency and communication benefit both security researchers and the companies they help protect.

( PAID CASE SOLVED CHECK COMMENT ) Scam With Security Researcher Luis Carchi Scammer Of GetShield.xyz

A security vulnerability report should end with acknowledgment, communication, and fair handling. Unfortunately, my experience with GetS...

Ashish Pathak Sec

Firefish Bug Bounty Scam

( PAID CASE SOLVED CHECK COMMENT ) Scam With Security Researcher Luis Carchi Scammer Of GetShield.xyz

Populars

Archive