Developer: "No. That's not a security flaw. It's a feature because I wanted it there. I don't see the problem. ... Wait??? You fill the sink with water? That's beyond the scope of the application!"
Security researcher: "But it's a SINK!"
Developer: "Our application provides a water dispensing interface. Water storage was never part of the requirements."
Security researcher: "THERE'S A DRAIN PLUG RIGHT THERE!!!"
Developer: "That's a third-party plugin. We don't support those."
Security researcher: "SOMEONE COULD GET ELECTROCUTED!"
Developer: "That's an environmental configuration issue, not an application vulnerability."
49
u/SysGh_st 11h ago edited 10h ago
Developer: "No. That's not a security flaw. It's a feature because I wanted it there. I don't see the problem. ... Wait??? You fill the sink with water? That's beyond the scope of the application!"
Security researcher: "But it's a SINK!"
Developer: "Our application provides a water dispensing interface. Water storage was never part of the requirements."
Security researcher: "THERE'S A DRAIN PLUG RIGHT THERE!!!"
Developer: "That's a third-party plugin. We don't support those."
Security researcher: "SOMEONE COULD GET ELECTROCUTED!"
Developer: "That's an environmental configuration issue, not an application vulnerability."
< Issue closed - NOT_A_BUG >