Stealing.info

Recently, I read an interesting blog post about how an AI tool leaked its Firebase configuration through JS files. In that post, they mentioned how they found it which really interested me, so I decided to create a similar scanner but for .bot domains. Within a few hours, I had

Imagine this: you're chilling on Discord with some friends, having a laugh, then suddenly you get a DM from someone you do not know. They are asking you for some help with their Discord bot! Nothing to worry about right? You're nice enough to reply and

TLDR; free R2 if you... click fast enough?!? What was the issue? I discovered that if you clicked Add R2 subscription to my account fast enough - before the Payment field loads - it would bypass R2's requirement to add a payment method to your account to prevent

What was the issue? Quiz Clothing's website was susceptible to XSS attacks in customer data fields. I tested with a few accounts (unfortunately the XSS prevented me from accessing the page to edit my account settings) and I could reproduce it with multiple possible attack methods. Examples I