Info leak
Source maps in production, with two API keys inside
The staging build shipped by mistake. Inside it: an internal admin endpoint and a third-party service key that was still live.
· 2 min read under $500
Info leak
Adding .css to a settings page and getting someone else's
The CDN cached anything that looked like a static file. The origin ignored the extension and rendered the account page anyway.
· 2 min read $1k - $2.5k