Scam Alert: scribblemaps.com — Reports of internal sensitive information disclosure were left unanswered
Company / Program: scribblemaps.com
Platform: Self-Hosted · Severity: high · Scam type: ignored
Published:
Reported by: Hassan Saad
I submitted two reports involving the disclosure of sensitive internal information that was accessible to anyone on the internet, but both reports were completely ignored.
They also do not provide a dedicated email address for bug bounty inquiries. I eventually found a customer support email and contacted them, but that team had no authority to handle vulnerability reports or take any action.
I didn't pursue the matter further because finding the information disclosure only took me about 30 minutes, so I simply stopped testing the platform. However, I wanted to warn other researchers about this program. It is listed on a well-known platform and advertises attractive bounty rewards, which may lead people to believe it is actively managed when that was not my experience