topic Re: Where to submit minor security finding for developer.spotify.com? in Spotify for Developers

Where to submit minor security finding for developer.spotify.com?

Fanicia — Thu, 28 Sep 2023 15:16:29 GMT

I have found a minor security issue on developer.spotify.com, and I am wondering where I should disclose it?

The issue isn't with the site itself, but rather that one of the tutorials is teaching developers to do something insecurely. While the security issue is by no means critical, I would like to disclose it non-publicly (just in case) to whoever is able to handle the issue.

I had a look at your Hackerone program, and this seems outside scope of that.

Re: Where to submit minor security finding for developer.spotify.com?

mauve_minnow — Thu, 28 Sep 2023 16:13:52 GMT

Hi Fanicia, you can share your findings with the Security Bug Bounty program. Spotify works with HackerOne to be sure that reported vulnerabilities are handled and the reporters are recognized for their contributions.

If your issue is outside the scope of that program, then you can report it to the Spotify support team here and they should be able to be sure it's dealt with properly.

Hope this helps!

Re: Where to submit minor security finding for developer.spotify.com?

alvaron — Fri, 29 Sep 2023 10:37:05 GMT

Hey,

Thanks a lot for reporting this. Could you please write me a private message with your findings? (click on my avatar and then "message")

Re: Where to submit minor security finding for developer.spotify.com?

Fanicia — Fri, 29 Sep 2023 11:23:38 GMT

Great. I've just sent you a DM with my report 🙂