<story><title>Stealing private documents through a bug in Google Docs</title><url>https://savebreach.com/stealing-private-documents-through-a-google-docs-bug/</url></story><parent_chain></parent_chain><comment><author>jackconsidine</author><text>A few years ago, I built a platform for a client that allowed his customers to show a &amp;quot;Text Me&amp;quot; widget on their websites; the software handled all of the SMS &amp;#x2F; messaging and basically substituted conventional contact form or Intercom integration.&lt;p&gt;His customers used Google AdSense, who started blocking them until they removed the widget. The reason? This widget used an Iframe postMessage, but appropriately specified the singular sandboxed domain. As expected, we never were able to speak with a human at Google- they just sent my clients customers intimidating emails about a security flaw on their websites.&lt;p&gt;Seeing Google abuse the postMessage API with a wildcard argument after this fiasco is maddening! If only they were held to their own arbitrary and vague standards.</text></comment>
<story><title>Stealing private documents through a bug in Google Docs</title><url>https://savebreach.com/stealing-private-documents-through-a-google-docs-bug/</url></story><parent_chain></parent_chain><comment><author>xyst</author><text>This was a bug that affected multiple products and even crossed into the enterprise suite and google only rewarded $3.3K USD?&lt;p&gt;It’s almost as bad as Apple’s reward program</text></comment>