Internal database credentials are public

[Deepak-Sharma755]

Hey @zai-org team @zRzRzRzRzRzRzR @shifengmin I am writing this second time to make you aware about that your internal databases, creds, staff, network are leaking.

I already send mails, dms everything that I can do to reach you but got nothing,
I find severe vulnerabilities in the zhipu ai , zai, aminer etc projects, these vulnerabilities are very critical.

I am hoping you will connect me to your security head or tech lead

[zRzRzRzRzRzRzR]

Where is this email sent to? May I ask, I haven't received the email notification.

[Deepak-Sharma755]

I sent mail to official zai userfeedback, report@aminer, service@zhipuai , startupzai and mails of team members( zixuanli, xu zou etc)
My email address from that I sent mails is

niketanrao6265@gmail.com

I already dm you and multiple zai affliates at x.

Please give me your mail , I will sent you detailed report of vulnerabilities or you can connect me to your security head.

Thanks for giving an attention to the issue

[schneidergithub]

@Deepak-Sharma755 are you referring to the git history and IP addresses like in this commit? 9b7d64a Because I could see this getting flagged by a security scan but isn't a "critical" vulnerability, local config settings aren't a huge risk in my opinion.

However, you specifically mention db creds, and that is something worth reviewing.

[Deepak-Sharma755]

@schneidergithub I wanna know are you zai official or a random person

Let me tell you I am reffering to the actual vulnerabilities that I found in the zhipu ai and it's projects sites like aminer

I rarely consider git commits serious

If you are from zai official then connect me to your security head

[Deepak-Sharma755]

@zRzRzRzRzRzRzR do you find my mail?

[schneidergithub]

@schneidergithub I wanna know are you zai official or a random person

Let me tell you I am reffering to the actual vulnerabilities that I found in the zhipu ai and it's projects sites like aminer

I rarely consider git commits serious

If you are from zai official then connect me to your security head

I am a "random" person, with an extensive cybersecurity background. Most vulnerabilities are found through git commits on github. You say you found actual vulnerabilities in its project sites. If it is not related to this repo, you are reporting in the place and wasting everyone's time. FYI you can talk to them through discord: https://discord.com/invite/QR7SARHRxK

[Deepak-Sharma755]

Basically I send mails to multiple researchers, team members, affliates of zai but they didn't reply thats why I raise issue here.

By the way thanks for the guidance, can you give me direct chatting platform username like Instagram, whatsApp etc where we can share thoughts, vision, discussion, opportunities faster

[zRzRzRzRzRzRzR]

I couldn't find your email, perhaps you could contact the admin directly on our Discord instead. Sorry about that.

[Deepak-Sharma755]

@zRzRzRzRzRzRzR any update brother, you are researcher you have direct access to security head, I think zai company doesn't take these vulnerabilities seriously

imagine if someone with bad intent find out these vulnerabilities

all your zcode users get hacked their credit card, every payment options, secrets, keys, root on their devices and you know financial consequences of this for both users and company himself

So please connect me to security head before it's too late

[Deepak-Sharma755]

@zRzRzRzRzRzRzR my email is niketanrao6265@gmail.com

Please check in spam section

We already wasted too much time in this, why don't you connect me to the security head or programmer directly we can fix vulnerabilities faster.

[Deepak-Sharma755]

I couldn't find your email, perhaps you could contact the admin directly on our Discord instead. Sorry about that.

I didnt disclose any vulnerabilities in the mail, in mail I am asking to connect with security head.

Now we are in contact so you can introduced me to security head directly, if you want me to mail then give me mail from where I get replies

[zRzRzRzRzRzRzR]

yes you can sent here: user_feedback@aminer.cn

[zRzRzRzRzRzRzR]

Additionally, we found an email you sent on June 20th, and I reminded my colleague to reply to you.