Ashish Pathak Sec

As an independent security researcher, I believe in responsible disclosure and helping organizations improve their security posture. This post documents my experience reporting multiple security issues to Firefish and the events that followed.<h2>The Reports</h2>Over time, I identified and responsibly disclosed multiple security-related findings affecting Firefish. These included:<ul data-spread="false"><li>Content Spoofing via Email Parameter</li><li>Missing Rate Limiting on Admin Login</li><li>Deprecated TLS 1.0 Supported</li><li>Missing Rate Limiting on Sign-Up Enables Mail Bombing</li><li>Missing X-Content-Type-Options Header</li><li>Missing HTTP Strict Transport Security (HSTS)</li><li>SPF Softfail (~all) Allows Email Spoofing</li><li>Weak DMARC Policy (p=quarantine Instead of p=reject)</li><li>Password History Reuse Allowed (Missing Password History Enforcement)</li><li>Server-Side Denial of Service via Unrestricted Password Length</li><li>Missing Content Security Policy (CSP) Header</li><li>Missing Self-XSS Protection</li></ul>Each report was documented and submitted through the appropriate channels following responsible disclosure practices.<h2>Payment Discussions</h2>After the reports were submitted, I was informed that a reward would be processed within one week. When that deadline passed, I was told the payment would be made the following week instead.During the process, I was asked to provide a complete list of all the issues I had identified so they could be evaluated together. I complied and submitted all of the findings.However, after the review process, all reports were ultimately classified as informational or otherwise ineligible for a bounty reward. Instead, I was offered a goodwill payment of 100 EUR. <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNfv46VVWBzV-tBeRYu-lY0Ba0_YoFKQhPoj6aUs4QogNU1ewjoJvto2D5Na4sMWcZFSLmLjed6_L0Ll_cr89wx4MTkCqRVb-7J4uGrngRgKaOn5OGes2Kh41Eg75ebbblGEDin4d3mzHhxWo_5crVJg2H-zReyLlCaigkn9JsGQ3LzUAVc19hA4cBEnM/s726/ffffffffffffffffffff.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="488" data-original-width="726" height="415" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNfv46VVWBzV-tBeRYu-lY0Ba0_YoFKQhPoj6aUs4QogNU1ewjoJvto2D5Na4sMWcZFSLmLjed6_L0Ll_cr89wx4MTkCqRVb-7J4uGrngRgKaOn5OGes2Kh41Eg75ebbblGEDin4d3mzHhxWo_5crVJg2H-zReyLlCaigkn9JsGQ3LzUAVc19hA4cBEnM/w618-h415/ffffffffffffffffffff.png" width="618" /></a></div>  Email : gorrdy@firefish.io<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCS_JJhoy1_rtJ3eDHL1SmubfTxLEte3dCmuD3BW9C7YT2Ymdvask_3dGGd-JWpIYz8hHBwiq7dwIkJ_JBHb3Q5VPIxH4LM5IlMaVPyQWK318Vv9i73X63l7Z6CWM8uuexogTVFjkhKeMdpp0LyXxZgNUZqXHES0203X6li83ngTI0_wG4GGYL8RkT214/s200/1774168949813.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="200" data-original-width="200" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCS_JJhoy1_rtJ3eDHL1SmubfTxLEte3dCmuD3BW9C7YT2Ymdvask_3dGGd-JWpIYz8hHBwiq7dwIkJ_JBHb3Q5VPIxH4LM5IlMaVPyQWK318Vv9i73X63l7Z6CWM8uuexogTVFjkhKeMdpp0LyXxZgNUZqXHES0203X6li83ngTI0_wG4GGYL8RkT214/s1600/1774168949813.jpg" width="200" /></a></div>  <h2>My Concerns</h2>Based on the scope and severity of the reported issues, as well as the time invested in identifying, validating, documenting, and responsibly disclosing them, I was disappointed with the outcome.My primary concern is not only the reward amount but also the process itself. Payment discussions took place, timelines were provided, and additional information was requested before the final decision was communicated. The delays and lack of clear communication made the experience frustrating.<h2>Why Transparency Matters</h2>Bug bounty and vulnerability disclosure programs rely on trust between researchers and organizations. Researchers invest their time and expertise to help companies identify and fix security weaknesses before they can be abused.Clear communication, transparent evaluation criteria, and timely responses are essential to maintaining that trust.<h2>Final Thoughts</h2>This article reflects my personal experience with Firefish's vulnerability disclosure process. I remain committed to responsible disclosure and security research, but I also believe researchers should be able to share their experiences openly and factually.<h2>Additional Findings</h2>Following the outcome of this process, I decided not to continue reporting additional issues that I identified during my research.At the time, I had reason to believe there were further vulnerabilities that warranted investigation, including a potential SQL injection issue. However, given my experience with the review and reward process, I chose not to invest additional time in preparing and submitting further reports.I believe responsible disclosure works best when there is mutual trust, transparent communication, and fair treatment of researchers. Unfortunately, my experience in this case left me unwilling to continue dedicating further research efforts to the platform.

Firefish Bug Bounty Scam

As an independent security researcher, I believe in responsible disclosure and helping organizations improve their security posture. This ...

Ashish Pathak Sec

Firefish Bug Bounty Scam

Populars

Archive