1 min readConfiguration exposure · Responsible disclosure
UNESCO: three emails to a Hall of Fame
A browser extension flagged an exposed configuration file on a UNESCO resource. Verified, reported on 7 June, listed in the Hall of Fame.
After the WHO finding, which came from subdomain enumeration and directory fuzzing, this one was almost the opposite: a browser extension I run while browsing flagged that it had found something.
Verify first
An automated alert is a lead, not a finding. I confirmed by hand that the configuration file really was publicly reachable before writing anything up.
The disclosure
- 7 June 2026: sent the report to UNESCO.
- They replied asking for my name and email for the acknowledgement.
- Listed in UNESCO's Hall of Fame for reporting a configuration file exposure.
Three emails from start to finish. A responsive triage team makes responsible disclosure easy.
Takeaways
- Passive tooling that runs while you browse is worth keeping on.
- Always verify an automated hit before you report it.
- A short, clear report gets a short, clear response.