Stefan Sundin

Reported vulnerabilities

•   2,500 pts

  Insufficient authorization checks for Gist APIs

  @stefansundin reported that several Gist API endpoints could be used to list a user’s secret Gists when using an OAuth access token that had been granted no authorization scopes. We addressed this issue by modifying these API endpoints to only include secret Gists if the token has the gist scope.

  Reported on 06-30-2015 for GitHub.com