Aaron Dewes

@aaron.nirvati.org

98 Followers 383 Following

Building @nirvati.eu.

Screenshot of an email reporting a security vulnerability, reading: [Security] Private Docker Registry publicly accessible - registry-mirror.nirvati.org Dear Sir/Madam, During a review of publicly accessible network resources, the following security issue(s) were identified on your server at registry-mirror.nirvati.org: [!] Your private Docker Registry on registry-mirror.nirvati.org is accessible without authentication. 83 private Docker images (containing your source code) are publicly accessible. --- Recommended immediate actions: 1. Enable authentication on the Docker Registry (basic auth or token-based) 2. Rotate any secrets in Dockerfiles or image layers 3. Block the registry from public internet access --- I am genuinely curious whether your organization runs a Bug Bounty program, and whether reports like this one are properly recognized and rewarded. Regardless of your policy, my primary concern is the security of your users' data - addressing these vulnerabilities helps prevent serious consequences: data breaches, infrastructure takeover, or financial losses. I am available to discuss the details, verify the fix, or help determine whether unauthorized access has already occurred as a result of this exposure. Best regards, Adam White Web Security
Screenshot showing a $500 donation to Gitoxide I made
A screenshot from Trae's package.json, showing Microsoft Corporation as the author.
A screenshot of the BlueSky app in German, with the @nerdjpg.com profile opened. The follower count is shown as an exact number.