Stealing OAuth tokens of Microsoft accounts via open redirect in Harvest App
Worth quoting here...<p>"...In the process of disclosing and patching this vulnerability, the Harvest team was barely responsive. The company acknowledged the vulnerability by triaging but took a very long time to fix the vulnerability. After 3 years of reporting, the company finally fixed the vulnerability silently and didn't bother to inform...no bounty or even HackerOne points were rewarded by the company..."<p>And from the company page..<p><a href="https://www.getharvest.com/security" rel="nofollow noreferrer">https://www.getharvest.com/security</a><p>"...Harvest cares deeply about protecting the privacy of the data entrusted to us by our customers. This is one of the core values at the heart of our business... "