{"action":"created","issue":{"url":"https://api.github.com/repos/liberapay/salon/issues/111","repository_url":"https://api.github.com/repos/liberapay/salon","labels_url":"https://api.github.com/repos/liberapay/salon/issues/111/labels{/name}","comments_url":"https://api.github.com/repos/liberapay/salon/issues/111/comments","events_url":"https://api.github.com/repos/liberapay/salon/issues/111/events","html_url":"https://github.com/liberapay/salon/issues/111","id":210057315,"number":111,"title":"Cloudbleed","user":{"login":"Changaco","id":1581590,"avatar_url":"https://avatars.githubusercontent.com/u/1581590?v=3","gravatar_id":"","url":"https://api.github.com/users/Changaco","html_url":"https://github.com/Changaco","followers_url":"https://api.github.com/users/Changaco/followers","following_url":"https://api.github.com/users/Changaco/following{/other_user}","gists_url":"https://api.github.com/users/Changaco/gists{/gist_id}","starred_url":"https://api.github.com/users/Changaco/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Changaco/subscriptions","organizations_url":"https://api.github.com/users/Changaco/orgs","repos_url":"https://api.github.com/users/Changaco/repos","events_url":"https://api.github.com/users/Changaco/events{/privacy}","received_events_url":"https://api.github.com/users/Changaco/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-02-24T14:09:02Z","updated_at":"2017-02-24T18:01:04Z","closed_at":null,"body":"Official sources:\r\n\r\n- [Incident report on memory leak caused by Cloudflare parser bug](https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/)\r\n- [1139 - cloudflare: Cloudflare Reverse Proxies are Dumping Uninitialized Memory - project-zero - Monorail](https://bugs.chromium.org/p/project-zero/issues/detail?id=1139)\r\n\r\nTL;DR there is a very small possibility that some private information belonging to Liberapay users was leaked.\r\n\r\nImportant data that could have been leaked:\r\n\r\n- bank account numbers, and postal addresses of their owners\r\n- identity information (full names, countries, and birthdays)\r\n- passwords\r\n- donations and transaction data (e.g. who you donate to and how much)\r\n\r\nNon-exploitable data that could have been leaked:\r\n\r\n- session cookies (6 hours timeout, potentially extended forever if you keep browsing but that doesn't happen in practice)\r\n- CSRF cookies (7 days timeout)\r\n\r\nInformation that isn't affected at all:\r\n\r\n- credit card numbers, they go directly to Payline\r\n"},"comment":{"url":"https://api.github.com/repos/liberapay/salon/issues/comments/282359883","html_url":"https://github.com/liberapay/salon/issues/111#issuecomment-282359883","issue_url":"https://api.github.com/repos/liberapay/salon/issues/111","id":282359883,"user":{"login":"EdOverflow","id":18099289,"avatar_url":"https://avatars.githubusercontent.com/u/18099289?v=3","gravatar_id":"","url":"https://api.github.com/users/EdOverflow","html_url":"https://github.com/EdOverflow","followers_url":"https://api.github.com/users/EdOverflow/followers","following_url":"https://api.github.com/users/EdOverflow/following{/other_user}","gists_url":"https://api.github.com/users/EdOverflow/gists{/gist_id}","starred_url":"https://api.github.com/users/EdOverflow/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/EdOverflow/subscriptions","organizations_url":"https://api.github.com/users/EdOverflow/orgs","repos_url":"https://api.github.com/users/EdOverflow/repos","events_url":"https://api.github.com/users/EdOverflow/events{/privacy}","received_events_url":"https://api.github.com/users/EdOverflow/received_events","type":"User","site_admin":false},"created_at":"2017-02-24T18:01:04Z","updated_at":"2017-02-24T18:01:04Z","body":"Do you have a list of third-party services that Liberapay uses?"}}
{"actor":{"display_login":"EdOverflow"}}