How I Found an Internal Compliance Document in Client-Side Code

This is a disclosure of a vulnerability found in getlynko.com under their VDP programme, which has since been resolved.

Lynko is a UK-based provider of premium NFC (Near Field Communication) smart business cards that instantly share a digital profile, contact details, social links, and booking tools with a single tap on any iPhone or Android device.

The vulnerability discussed below is a classic case of Information Disclosure and Broken Access Control (OWASP Top 10 A01:2025), specifically mapped to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-540 (Inclusion of Sensitive Information in Source Code).

Prologue

I was casually sipping my morning coffee, mentally prepared for a six-hour pentest (because that’s my threshold) when, within the first fifteen minutes of recon, I discovered something I shouldn’t have been able to

Methodology

Robots.txt: Hunting Hidden Endpoints

Like always, I started by checking robots.txt to get a...

Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE