
Still public merchant information
It looks like some store and merchang APIs were not protected back when [Wayback/Archive] Dotpe API Security Breach — bool.dev was published.
Reminder to self: check their status now as I can’t believe their “human error” got fixed properly.
History (reverse chronological order):
- [Wayback/Archive] How DotPe’s ‘Human Error’ Exposed Confidential Customer API Data
- [Wayback/Archive] Deedy on X: “Today, Google-backed DotPe locked down their APIs by rate-limiting by IP on /external/merchant and blocking others. They sent a legal notice to the author before fixing it and haven’t publicly acknowledged the issue at all. Companies must be held accountable for poor security.…”
[Wayback/Archive] Tweet JSON: [Wayback/Archive] GYSlTthakAEoojp.png:orig (2346×1838)
-

Now protected private API
[Wayback/Archive] Deedy on X: “6 hours later, the API is still very much public! …”
[Wayback/Archive] Tweet JSON: [Wayback/Archive] GYK38dXbkAEEEs_.jpg:orig (1358×1798)





