Researcher Receives 400,000 Corporate Emails Just by Buying an Unused Domain

·1 views

Security researcher Cory Solovewicz purchased the domain noreply.net in 2024 and unexpectedly began receiving a flood of sensitive corporate emails not intended for him. Since acquiring the domain, he has collected over 400,000 messages and 28,000 attachments from roughly 6,200 organizations. The emails contained test credentials, employee data, customer orders, and injury reports, all sent by companies that assumed the address was a dead end. The core flaw is that many automated systems treat addresses like 'noreply' as non-functional, while in reality any email sent to a live domain reaches whoever owns it. A separate researcher, Mike Sheward, independently confirmed the same vulnerability after purchasing domains like deleteduser.com and receiving hotel bookings, vacation requests, and meeting invitations.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How SDCC Compiler Transforms C Code for 8051 Microcontrollers

Developers can deepen their understanding of compiler behavior by disassembling binaries and comparing them against original C source code, a technique particularly useful for 8-bit microcontrollers like the 8051. The SDCC compiler is used to compile a test C program covering arithmetic, control flow, function calls, and pointer operations into an Intel HEX file. This output is then converted into a ROM binary using tools like objcopy or makebin for simulation. The MCU 8051 IDE is used to simulate the resulting binary on a standard 8051, which offers just 4KB of ROM and 128 bytes of RAM. Given these tight memory constraints, the exercise highlights how every byte matters when writing and compiling C code for such resource-limited architectures.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

HazelJS Skillgate Trims CMS APIs Into Controlled Agent Skill Sets Using NodeJS

Developers working with AI agents often expose entire CMS APIs, which degrades tool selection and leaves dangerous endpoints accessible. HazelJS Skillgate addresses this by reading an OpenAPI spec and converting only a curated, tagged subset of endpoints into discrete agent skills. Each skill is classified as read-only or write, with write operations flagged for approval and destructive methods excluded entirely. The system maps HTTP methods and OpenAPI tags to determine which endpoints qualify, using an opt-in editorial tag to filter the surface down to relevant operations. The result is a smaller, labeled toolset that improves agent precision and reduces the risk of unintended or harmful API calls.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

NodeJS Tool Skillgate Converts DevOps APIs into Risk-Classified AI Agent Skills

A developer tutorial published on DEV Community introduces Skillgate, a NodeJS-based layer that converts standard OpenAPI specifications into governed sets of AI agent skills. The tool addresses the security risk of giving AI agents unrestricted access to DevOps APIs, where unchecked calls could trigger costly scaling events or delete critical records. Skillgate automatically classifies each API endpoint by risk level: GET requests become read-only skills, POST and PATCH routes require approval, and DELETE operations are blocked outright. The system replaces manual route whitelisting, which tends to break when APIs change, with an opt-in curation model that applies automatic risk classification. The post clarifies that live human-approval workflows and crash-resilient runtime handling are outside Skillgate's scope and are addressed by a separate Agent OS runtime.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Bug in Element Web Could Silently Block User-Submitted Bug Reports

A developer reviewing Element Web's bug-reporting code discovered that two await calls for optional crypto diagnostics were placed inside the critical path of report construction. If either call rejected, the entire report object would fail to form, preventing both the rageshake bundle and any Sentry event from leaving the browser. Element Web is the web client for Element, a Matrix-based messaging application. The flaw meant that a broken subsystem being diagnosed could effectively veto the diagnostic report a user explicitly chose to submit. The developer verified the issue against a real Sentry Browser SDK with a local transport, confirming zero events were captured before the fix and exactly one after.

0 comments Read more at DEV Community