How to Source a Contact Number for Responsible Disclosure
Description
The image is a screenshot of a chat conversation, likely on WhatsApp, depicting an interaction between a security researcher and a company representative. The researcher initiates contact, stating: 'Hi, [redacted] a security issue. some details are public through a MongoDB with no Authentication' and asks for a security contact. The representative thanks them and then asks, 'May I know where did you get this number from?'. In a perfect punchline, the researcher quotes their own initial message and replies, 'the same database', with the words underlined in red for emphasis. This meme humorously and painfully highlights a common and severe security misconfiguration where databases, particularly MongoDB, are left publicly exposed without authentication. The irony is that the company's own contact information was part of the data leak, showcasing a complete lack of security awareness and making the representative's scripted question absurd
Comments
8Comment deleted
That awkward moment when your bug bounty program is just a public `SELECT * FROM contacts;`
Great job on the end-to-end encryption banner - meanwhile your MongoDB on port 27017 is livestreaming the CISO’s phone number to anyone who can spell “shodan.”
When your MongoDB is so open it's basically a public API, but at least it's consistent - even the incident response contact info follows the same security model
MongoDB's legacy default of trusting the network so much it didn't ask for a password - the only auth in this story is the WhatsApp encryption banner
The beautiful irony of reporting a MongoDB security breach through WhatsApp's 'secured with end-to-end encryption' banner, only to reveal you found their contact info in the same unsecured database - a perfect demonstration of why defense in depth matters. It's like leaving your front door wide open while installing a state-of-the-art safe inside. The researcher essentially said 'I found your vulnerability' and when asked 'how did you find us?' replied 'through your vulnerability' - the most elegant proof-of-concept possible. This is what happens when you secure the application layer but forget about the data layer: your MongoDB becomes the world's most helpful phone book for security researchers
MongoDB's ultimate self-audit: leak the hotline, then field calls on the leak from the leak
Defense in depth: the chat is end-to-end encrypted, but one end is an unauthenticated MongoDB with bindIp 0.0.0.0 - where I found your phone number
Great E2E on WhatsApp; shame the backend is E2W - db.users.find({}) on :27017 shouldn’t be your incident contact directory