On Stackoverflow, I have flagged a question for security purposes. The user has provided a link to the admin panel of their site along with a username and password. As these credentials are for a super user, anything can be done on the site.

I posted this flag on 15th January and 5 days later, it's still pending (active). I'm fully aware that the Mods have a lots of things to do, however seeing as this poses a rather big threat, I thought I would bump it on here. I assume the Mods have some sort of page with pending flags, therefore I won't post a link to the question on here for security purposes.

Maybe it might be an idea to add another option to the "flag reasons" list, which makes it a top priority and can be dealt with quickly.

  • You have enough rep on SO to at least remove the link and info from the current revision. Did you do so? Jan 20, 2014 at 11:24
  • 2
    And an additional flag type won't help here; what makes you think Joe Soap won't use it for trivial matters? Everyone thinks their flag is urgent. Jan 20, 2014 at 11:25
  • Realistically isn't the OP deliberately doing this. I mean they are not exactly being wise, but its not like we can protect people from themselves (beyond perhaps telling them why its deeply unwise) Jan 20, 2014 at 11:26
  • Is it actually a security issue in this case? Like @RichardTingle says, OP is deliberately giving the (what I assume to be temporary) login credentials in order to find out the cause of a problem with logging in to his admin panel.
    – Stijn
    Jan 20, 2014 at 11:31
  • 1
    @MartijnPieters - I do indeed, however this can still be seen in the edit history.
    – Lodder
    Jan 20, 2014 at 11:39
  • Yes, the OP is deliberately providing details, however what's to stop me or anyone else from completely screwing up the website? It's the same as people providing their database details, it can simply result in SQL injection.
    – Lodder
    Jan 20, 2014 at 11:41
  • @Lodder: sure, but it's a first step. The moderators cannot do any more either, removing text from the post revisions is something requiring a Stack Exchange developer. Jan 20, 2014 at 11:42
  • @Lodder I take it you're of the "people shouldn't be allowed to do things that would hurt themselves" school of governance. Regardless, these "log into my website" questions are of no use to anyone but the OP and should really be prevented for normal moderation reasons Jan 20, 2014 at 11:45
  • @RichardTingle - I simply believe that people should be aware that posting credentials like this can pose major security risks. Questions can be viewed by anybody out there, meaning that anybody can look simply log into the backend, completely remove everything and log out with a smile on their face. Yes, editing the question and removing this information can be done, which does help to a certain extent, but then again, anybody with editing permissions can see this information in the history. Personally, It's always good to stay on the safe side. Anyway, Rory's answer summed it up ;)
    – Lodder
    Jan 20, 2014 at 11:52
  • @Lodder I suppose I am working under the assumption that the security hole is so huge and obvious that the OP must have known that and done so willingly. But perhaps I am overestimating people (if so: is deeply worried) Jan 20, 2014 at 11:54
  • 1
    see also: meta.stackexchange.com/questions/132117/…
    – tombull89
    Jan 20, 2014 at 11:59

1 Answer 1


Stack Exchange is not in a position to be able to confirm whether this is a security issue, however as it may be one, your best bet is to edit the post yourself, removing the credentials and giving the reason.

This will alert the OP, who can take action.

If they want to, they can speak to a site mod who can escalate to have revision history removed. We have this issue reasonably regularly on Security.SE - where someone posts credentials, links or otherwise sensitive info. If necessary, I or one of the other mods requests the community team remove the history, but this is usually decided after speaking to the OP.

  • Thanks for the info. I will bare this in mind for future reference. I was not aware that removing revision history was possible.
    – Lodder
    Jan 20, 2014 at 11:47
  • It is only possible by SE employees, but if there is a good reason to do it (such as sensitive information, personal information etc) then it is worth requesting.
    – Rory Alsop
    Jan 20, 2014 at 11:49
  • @Lodder - Part of the slow response on a flag like this is that moderators can't remove these revisions ourselves. We have to call in an SE employee, and we don't have a great way of doing that now, short of chat pings or email. I often leave these active even when I've seen them, if I know I'm not going to be able to get a hold of an SE employee right then. Otherwise, it could be forgotten. Jan 20, 2014 at 18:55

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .