<story><title>Cracking My Windshield and Earning $10k on the Tesla Bug Bounty Program</title><url>https://samcurry.net/cracking-my-windshield-and-earning-10000-on-the-tesla-bug-bounty-program/</url></story><parent_chain></parent_chain><comment><author>jxcl</author><text>This bug probably existed because some developer thought &amp;quot;this is an internal application, I don&amp;#x27;t need to apply the same rigorous input&amp;#x2F;(edit: and output, as replies point out) sanitation as I do with normal sites because it&amp;#x27;s only accessible by VPN.&amp;quot;&lt;p&gt;As a consultant that gets to see a lot of &amp;quot;internal only&amp;quot; applications, this is one of the misconceptions that me and my coworkers try to fight against. XSS is effective even if the attacker doesn&amp;#x27;t have access to the internal application, because it&amp;#x27;s not the attacker&amp;#x27;s computer making the requests.</text></comment>
<story><title>Cracking My Windshield and Earning $10k on the Tesla Bug Bounty Program</title><url>https://samcurry.net/cracking-my-windshield-and-earning-10000-on-the-tesla-bug-bounty-program/</url></story><parent_chain></parent_chain><comment><author>gibolt</author><text>What a great response and turnaround. Bug as fixed within 24 hours and paid out within a month.&lt;p&gt;I wouldn&amp;#x27;t expect any other car manufacturer to respond ever, most don&amp;#x27;t even own their software stack.</text></comment>