Tag: information-disclosure

All the articles with the tag "information-disclosure".

• Exposed MCP Config: Triaging a Leaked Hugging Face Token

  kOaDT

  9 Nov, 2026

  Finding an AI agent's MCP config in the web root, working out what its Hugging Face token opens, reading a private dataset with the official Hub client, then revoking the token.

• Exposed .git Repository: Recovering a Dropped Stash from Unreachable Objects

  kOaDT

  2 Nov, 2026

  Dumping a .git directory left in the web root, then recovering a production secret from a stash the developer dropped but Git never deleted.

• Reading Secrets From the Browser: The NEXT_PUBLIC_ Trap in Next.js

  kOaDT

  18 Apr, 2026

  Exploiting a misused NEXT_PUBLIC_ environment variable in OopsSec Store to recover a payment secret embedded in the client JavaScript bundle.

• Leaking Secrets Through Error Messages: Exploiting a Verbose API Debug Response

  kOaDT

  4 Apr, 2026

  A data export endpoint dumps system diagnostics when it hits an invalid field. Feed it garbage, read the debug output, grab the flag.

• Plaintext Password Exposure: Exploiting Server Logs via a Hidden SIEM Interface

  kOaDT

  17 Feb, 2026

  Exploiting a forgotten debug statement that logs plaintext passwords and a hidden SIEM dashboard with hardcoded credentials to retrieve a flag.