lmai

How long should one give for a website to fix their security flow before warning their customers? Corollary: How should it be done since I can't reach out to their customers?<p>Background: The hack is simply changing the id variable in the url. It's a serious bug as you can view some of my photos from my various social networks. This could be detrimental to the VC backed company as they just did a Groupon-type deal (which is how I came to be a customer).

First time poster here, cause it's the first time I had something important to say.

I was using a site for a project. I noticed the url structure seemed too simple. So I changed a single variable (the id variable of course) and voila! I get another person's project.

This is not some random site, this is a funded startup back by a well-known VC.

Reminder to developers and investors - think about security, especially those with sensitive information. Why haven't we learned from past mistakes? If they had read/followed HN, they would have seen this about Quiptxt http://news.ycombinator.com/item?id=1226313

I have notified the company of their security flaw. Now lets see how they respond. It could be a difficult task for them as I suspect they have a lot of new customers using their service.

* update - I spoke to customer service and they graciously acknowledged the issue.