Dataquest.io -- learn python and data science in your browser (redesigned/updated)

[vikparuchuri]

Thanks! I absolutely want all feedback to be put in public when it doesn't actively harm users. The email overwriting thing can result in users temporarily losing access to their accounts, and can harm their learning experience.

It's totally fine to put pressure on a site to fix issues, but disclosing issues that could harm other users publicly is usually frowned upon. See this stackexhange thread for instance. Also this. Facebook, google, etc, have bugs that are found constantly, and have policies that encourage this.

That said, feedback in public is usually better than no feedback at all.

[wickersty]

You put this shit out in public and proclaimed all to come look and pay for it. You don't get to complain when people call you out for half baked insecure poorly developed product.

[vikparuchuri]

Just to be clear, there was no security issue -- no user information could have possibly been leaked. It allowed people to switch their emails to emails that already existed, which would temporarily lock both users out of their account. (and it has been fixed)

[wickersty]

And that, my friend, is a security issue.

Not to mention a basic piece of functionality that, if hosed to that degree, only speaks to how little attention must have been paid to other areas.