Comment by reassess_blind

Reminds me of a bug I found in a very popular browser testing service that spun up iOS vm's/devices for on-device testing.

I copied the clipboard from the device, and my clipboard was full of another users credentials that they were obviously trying to paste into their own VM. Their devices were leaking clipboard data to each other.

I reported the vulnerability and asked if there was any bounty program (I wasn't looking for vulnerabilities but didn't hurt to ask), to which they said no, but they could send me a signed letter thanking me of my contributions. I said, great, thanks - and never heard back.

All pretty disappointing.