man, we love working with vercel, both their ceo and cto joins the slack channel to handle things, they are incredible at handling disclosures, we always have best experience dropping research on them.
顯示更多
You probably heard about the OpenAI white-hat hack earlier today by @S1r1u5_ and friends.
The same vulnerability impacted most image processing where images can be under attacker control (like an app with profile picture upload), and with that next.js' image optimization support.
Here is the story of how we handled this event, helped track down "the literal guy in Nebraska" that @xkcd predicted and get the underlying issue fixed.
Also, notable, when using image optimization through Vercel's platform you are protected from exploitation through sandboxing of the code that handles potentially hostile payloads.
顯示更多
