Security Hall of Fame
Helping Keep the Technology We Support Safe
At 4leggedIT, technology exists to help animal rescues, shelters, foster-based organizations, and other dog-related organizations and businesses we support do more good with the resources they have. That includes keeping their websites, applications, forms, and other technology as secure as possible.
Our Security Hall of Fame recognizes security researchers and members of the ethical security community who have responsibly reported vulnerabilities affecting technology managed or maintained by 4leggedIT.
We appreciate the time, expertise, and good faith these individuals contribute to making the technology we support safer.
Recognition below reflects the specific report described and nothing more — it is not an endorsement of a researcher's other work, opinions, or platforms.
Quick Path
- See who's been recognized in Our Hall of Fame.
- Researchers choose how they're credited, or stay anonymous.
- Report a vulnerability to woof@4leggedit.com under our Vulnerability Disclosure Policy.
Our Hall of Fame
Thota Murari
Reported three related findings in the backend data layer over a single day: an overly permissive data-access rule, a backend function reachable without its intended safeguard, and an admin login check enforced only in the browser rather than the server.
https://www.linkedin.com/in/thota-murari-1abb92285
Corrective Action
All three were fixed and verified the same day. The reports also prompted a full proactive review of adjacent systems, not just the three issues raised.
Shubham Mali
Reported a missing email authentication (DMARC/SPF) configuration allowing domain spoofing across multiple 4leggedIT-managed domains.
https://www.linkedin.com/in/hackwithshubham/
Corrective Action
SPF, DKIM, and DMARC were configured and enforced across all 4leggedIT-managed domains, not just the ones named in the report.
Immadisetty Kiran Kumar
Reported two related findings on 4leggedIT's public-facing infrastructure: internal hostnames and private network addresses exposed in the public DNS zone, and a CORS configuration on the Cloudflare Access layer protecting the admin portal that trusted any requesting origin.
https://www.linkedin.com/in/i-kirankumar
Corrective Action
The exposed DNS records were removed. The CORS policy on the affected endpoints was locked down; a platform-level piece of how it's enforced is still being worked through, so that part is being treated as mitigated rather than fully closed.
Pradyumntiwarinexus
Reported a weak registration password policy that allowed a user's email address to be used as the account password on the 4leggedIT User Portal.
https://www.linkedin.com/in/pradyumn-tiwarinexus-b270561b1/
Corrective Action
Server-side validation was added the same day to reject a password matching the account's own email address. This finding also set the pattern later used to evaluate similar password reports on the same portal.
Botta Sai Prasad
Reported missing HTTP security headers (including HSTS and a Content Security Policy) and invalid email formats being accepted during registration on the 4leggedIT User Portal.
https://www.linkedin.com/in/botta-sai-prasad
Corrective Action
The missing headers were added and rolled out to every other 4leggedIT-managed site as a precaution, not just this one. Server-side email-format validation was added to registration the same day.
Kiran Daraboina
Reported a missing Content-Security-Policy header across 4leggedIT's public-facing sites.
https://www.linkedin.com/in/reckiran/
Corrective Action
A Content-Security-Policy header was implemented fleet-wide, and is now checked automatically at every build so it can't silently disappear in a future deploy.
Maturi Jaswanth Sai Madhu Mohan (Jashu)
Reported an unsandboxed iframe in the Adopt-a-Pet widget that ran a third-party script with the parent page's full origin access, and a JSON-LD serialization issue where an unescaped character in a content-authored field could break out of a structured-data script tag and inject live markup, along with related unvalidated link-scheme checks across several content patterns.
https://www.linkedin.com/in/maturi-jaswanth-sai-madhu-mohan
Corrective Action
The iframe was sandboxed and its input validated. The JSON-LD serialization was fixed to escape the breakout character, and a shared link-safety check was added everywhere content-authored URLs are rendered, both fleet-wide.
Vimalatithyan S
Reported that the shared link-safety check used across 4leggedIT-managed sites could be bypassed using backslash and control-character tricks in a relative-style path, letting a crafted value pass validation but resolve to an external site once the browser parsed it.
https://www.linkedin.com/in/vimalatithyan
Corrective Action
The check was rewritten to validate the fully resolved URL rather than its surface pattern, and rolled out fleet-wide. During the fix, a related gap allowing plain protocol-relative links to bypass the same check was also found and closed.
If you discover a potential security vulnerability in a system within the scope of our Vulnerability Disclosure Policy, we encourage you to report it responsibly. We do not offer monetary bug bounties, but with your permission, we'd be happy to recognize your contribution here.
Security Contributions
Not every report rises to the level of a confirmed vulnerability, but we still value the time and good-faith testing behind it. This section recognizes contributions of that kind, separate from Our Hall of Fame above.
T. Jaswanth (Tippagalla Jaswanth)
Reported registration behavior in the 4leggedIT User Portal. Assessed as not a vulnerability, since the portal doesn't expose or grant access to any 4leggedIT system, account, or infrastructure, but the report surfaced a real gap: nothing on the page explained that.
https://www.linkedin.com/in/tippagalla-jaswanth-36a956321
Corrective Action
A disclaimer was added to both the login and registration views explaining the portal's actual scope.
Bhargav Subrahmanyam Kalla
Reported a broken donation link on the example rescue site's Donate page. The link was always a placeholder by design, since that site is a demo/template, not a real organization taking donations, but a visitor landing directly on that page had no way to know that.
https://www.linkedin.com/in/bhargavinfo
Corrective Action
The demo-site disclosure banner now appears on every page of the site, not just the homepage.
Uday Patel (uday637)
Flagged a theoretical resource-exhaustion risk from unusually large password inputs on the User Portal registration flow, and explicitly avoided testing it in a way that could affect the live site.
https://www.linkedin.com/in/uday-9a4bb4342
Corrective Action
A server-side maximum length was already in place from an unrelated fix the day before. Credited for responsible testing and for confirming the existing control actually held.
Nandyala Harsha Vardhan
Reported that the placeholder social media links on the example rescue site pointed at account names that had never been registered, and demonstrated that an unregistered account name can be claimed by someone else. That site is a demo/template rather than a real organization, so there was no operational account to impersonate, but the links were still pointing somewhere outside our control.
https://www.linkedin.com/in/harsha-vardhan-nandyala-353791321
Corrective Action
Every placeholder link on the demo site now points at the relevant platform's own homepage instead of a named account, so there is no unregistered account name left for anyone to claim.
Recognition
Researchers may choose how they are recognized. Options include:
- Full name
- Name and organization
- Security research handle
- Website or profile
- Anonymous
We will never publicly identify a researcher without their permission.
Responsible Disclosure
Our Security Hall of Fame is made possible by responsible disclosure.
If you believe you have discovered a security vulnerability affecting a 4leggedIT-managed website, application, API, integration, or other in-scope technology, please report it rather than publicly disclosing the issue.
Reports can be submitted to:
Please review our Vulnerability Disclosure Policy before conducting security research.
Why It Matters
The technology we support can handle everything from adoption applications and volunteer information to rescue communications and animal records.
A security issue isn't just a technical problem. For a small organization operating on limited resources, it can become a real-world problem for the people and animals depending on it.
That's why we appreciate the people who help us find problems before they become bigger ones.
Security Researchers
Want to be recognized here? Submit a responsible vulnerability report and let us know how you'd like to be credited.
To everyone who has helped make the technology we support a little safer: thank you. 🐾