Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 158 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

Do not report security issues on meta; contact Stack Exchange directly instead. For more information, see "How do I report a possible security vulnerability?" in the Help Center.


If I found a serious security issue (e.g. which makes it possible to use spam bots, sign in with fake OpenIDs etc...), what should I do?

  • Add a bug report on meta (which makes it possible for everyone to abuse it if they know the issue exists :-) )
  • Contact the Stack Overflow team (Jeff Atwood etc...)
  • Something different?

Oh, I don't say I found one, but, well, just in case...

share|improve this question
3  
You should use it to give me more rep then Jon Skeet! – Dexter Sep 15 '09 at 20:42

E-mail team@stackoverflow.com

share|improve this answer
32  
...and put in your bid for the Hacker badge. – Bill the Lizard Sep 15 '09 at 19:52

We encourage all security reports to be sent to team@stackoverflow.com and they are all followed up on.

That said I currently don't see any in the mailbox..

share|improve this answer
2  
Maybe he's just asking a hypothetical? Just in case though: everybody look for the hole! – TM. Sep 15 '09 at 21:47
7  
Falls into a hole. – Ólafur Waage Sep 15 '09 at 21:48
3  
Ólafur, look out for the hole. – Bill the Lizard Sep 16 '09 at 2:02
2  
In addition to the hypothetical angle, I have a feeling this is a "Future Reference" kind of question... – Margaret Sep 16 '09 at 11:50

After contacting the developers and giving them some time to fix the problem, if there is still no solution, I believe that it is appropriate to go public with it. As long as the developer is genuinely working with you to solve the problem and isn't simply invoking delaying tactics, I would hold off on going public. If they have had enough time and still haven't addressed it, then going public is a last resort to getting them to address a security issue. I wouldn't go so far as to give an implementation, but you should be able to give enough information that the problem is obvious to others.

share|improve this answer
3  
How does "going public" with a security hole help anybody? Maybe I'm misunderstanding, but that sounds more like a bullying tactic than an action performed by someone who genuinely cares about Stack Exchange and its users. – jmort253 Sep 26 '13 at 18:35
4  
@jmort253 I was only suggesting it in the event that the concern wasn't being addressed. The fact that a security hole exists and isn't being addressed is sufficient reason to warn others who might be negatively impacted. E.g, say your bank has been warned about a security issue that would allow access to an arbitrary account. The bank is no more secure if it's never disclosed publicly; another, less scrupulous person could just as easily find it and exploit it. Going public, as a last resort, gives the bank's customers the ability to effect their own security by closing their account. – tvanfosson Sep 26 '13 at 19:32
    
I guess I can see your logic, but there's so many layman-types out there, maybe not on Stack Exchange but definitely banking customers, that wouldn't really understand the impact of the bug; therefore, going public would just help nefarious individuals take advantage of those folks. To me, it feels like putting a sign up in your neighbor's front-yard announcing that he doesn't lock his doors, except your neighbor stores stuff for folks in the neighborhood, so the sign puts them at risk too if they don't have other options. – jmort253 Sep 26 '13 at 21:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .