Software development jobs are too accessible. Jobs with access to/control over millions of people's data should require some kind of genuine software engineering certification. It is ridiculous how we've completely normalised leaks like these on a weekly or almost-daily basis.

Hopefully this can be patched soon.

Their robots file specifically has the code to disallow search engine crawling commented out - https://fiverr-res.cloudinary.com/robots.txt.

---

     See http://www.robotstxt.org/wc/norobots.html for documentation on how to use the robots.txt file
     #
     # To ban all spiders from the entire site uncomment the next two lines:
     # User-Agent: \*
     # Disallow: /

That's wild. Thousands of SSNs in there. Also a lot of Fiverr folks selling digital products and all their PDF courses are being returned for free in the search results.

really bad stuff in the results. very easy to find API tokens, penetration test reports, confidental PDFs, internal APIs. Fiverr needs to immediately block all static asset access until this is resolved. business continuity should not be a concern here.

You followed the correct reporting instructions.

https://www.fiverr.com/.well-known/security.txt only has "Contact: security@fiverr.com" and in their help pages they say "Fiverr operates a Bug Bounty program in collaboration with BugCrowd. If you discover a vulnerability, please reach out to security@fiverr.com to receive information about how to participate in our program."

Wow, surprised this isn't blowing up more. Leaking form 1040s is egregious, let alone getting them indexed by Google...

I wrote to Cloudinary for what it's worth. This is brutal.

Probably not in scope but maybe https://bugcrowd.com/engagements/cloudinary will care?

This is bad.

This is crazy! So many tax and other financial forms out in the open. But the most interesting file I’ve seen so far seems to be a book draft titled “HOOD NIGGA AFFIRMATIONS: A Collection of Affirming Anecdotes for Hood Niggas Everywhere”. I made it to page 27 out of 63.

this is a bad leak

Woah that's brutal all the important information is wild in public

> Moreover, it seems like they may be serving public HTML somewhere that links to these files. As a result, hundreds are in Google search results, many containing PII

This is not how Google works.

They bought and.co and then dropped it. strange company

Burn it to the ground.

Just by scrolling over it that's really rough.

Loooool what a mess