Ppl have been accused of crimes for pointing out, in a 100% white-hat way, that a site lets you access other ppl’s accounts just by incrementing a number in the URL. No verification against it.
If someone abuses that maliciously? Sure, go after them. But these were honest security white-hats trying to warn, before scammers exploited it.
To be fair, being accused for that is exceptional, not normal. But it has happened. More than once!
You jest, but i know a person that was accused of “hacking” a website by removing a client-side form validation check
Ppl have been accused of crimes for pointing out, in a 100% white-hat way, that a site lets you access other ppl’s accounts just by incrementing a number in the URL. No verification against it.
If someone abuses that maliciously? Sure, go after them. But these were honest security white-hats trying to warn, before scammers exploited it.
To be fair, being accused for that is exceptional, not normal. But it has happened. More than once!