Security research
Every vulnerability listed here was discovered by OpenHack in real-world open-source software. We practice responsible disclosure and work with maintainers to ensure fixes are available before publishing details.
User-controlled redirect URLs from the OAuth state parameter are passed directly to res.redirect() without getSafeRedirectUrl() validation in Stripe Payment and Feishu Calendar callback handlers, allowing redirection to arbitrary external domains.
Read full advisoryA missing `await` keyword on `getServerSession()` in Papermark's TUS file upload endpoint causes a complete authentication bypass, allowing unauthenticated attackers to upload arbitrary files up to 2 GB.
Read full advisoryOpenHack follows responsible disclosure practices. When we discover a vulnerability, we notify the vendor immediately, provide full technical details and remediation guidance, and coordinate a disclosure timeline that gives maintainers adequate time to ship a fix before any public advisory is published.
If you believe you've found a security issue in OpenHack itself, please reach out to security@openhack.com.
