Critical Bubble Vulnerability (Terms of Service Violation) They Don't Seem To Care Enough About

[mikeloc]

@sam.morgan

Specifically as it relates to security issues, we would like to generally discourage these types of posts. There is nothing productive to be gained from publicizing any security concern outside of a responsible disclosure process

@sam.morgan… is it worth unlisting this post at this point so it can only be accessed via a direct link?

[tylerboodman]

My app for example doesn’t have any place for public file uploads, it’s all only for logged in users. So maybe at least for that example you could specify “file uploads require login” and it closes this loophole app-wide. Just a thought but I know that doesn’t apply to most apps.

I like @sam.morgan 's response much better than the initial email screenshot so thank you for the reply

[can.olcer]

@sam.morgan

Specifically as it relates to security issues, we would like to generally discourage these types of posts. There is nothing productive to be gained from publicizing any security concern outside of a responsible disclosure process, which in our case involves using our bug report form and working with our support team.

Of course there’s something productive to be gained: It’s important for your customers to know that this is a security vulnerability that’s unfixed and has been unfixed for months.

[nicholasrbarrow]

@sam.morgan thanks for your reply; I do agree with @tylerboodman that your response was much better than the one I originally received. However, as it pertains to

@sam.morgan

There is nothing productive to be gained from publicizing any security concern outside of a responsible disclosure process

I respectfully disagree. I gave your support rep. ample opportunities and time to respond–instead of dismissing–the security concerns. Bubble clearly lacks “a responsible disclosure process” if a known and industry-recognized security vulnerability has remained on your platform for so long.