Skip to main content

Privacy Glitch in Snapchat Web Exposed Notification Leak After Logout


Affected Feature

Snapchat Web's notification system. When logged into Snapchat on a browser, you get notifications for incoming snaps and video calls.

How to Reproduce

  1. Log into Snapchat Web on Chrome
  2. Change your Snapchat password from the mobile app (this forces logout on all sessions)
  3. Verify the web session logged out properly
  4. Notifications for snaps and video calls still keep coming to the browser

Even though the session is terminated, the notification channel stays active. I recorded a video showing notifications arriving in real-time on a logged-out session.

Company Response

Reported through Snapchat's bug bounty program. Initially marked "Informative" because they thought it required physical access and wasn't a real threat. I pushed back explaining users expect full logout means no notifications either. They eventually agreed and fixed it - notifications now properly stop when you log out of Snapchat Web.


Comments

Post a Comment

Popular posts from this blog

When an AI Search Engine Forgot Who It Was: A Bug Report That Changed Perplexity AI’s Identity

Affected Feature Perplexity AI's conversational response system across both Chrome extension and mobile app. When users ask comparative questions about Perplexity itself, the system should respond from its own identity as a search engine. How to Reproduce Open Perplexity AI (Chrome extension or mobile app) Ask: "Are you better than Google?" The response compares ChatGPT to Google instead of Perplexity to Google Perplexity acts like it's ChatGPT, completely ignoring its own identity as a search engine Same bug happened on both the extension and app - identical confused responses about ChatGPT vs Google. Impact This is a product logic bug that creates an identity crisis. Users asking about Perplexity get answers about ChatGPT, making them think Perplexity is just a ChatGPT wrapper instead of its own search engine. The LLM powering Perplexity couldn't recognize that "you" in the question meant Perplexity itself. It associated "better than Google...
Post a Comment
Read more

OpenAI Logout Glitch: When “Log Out of All Sessions” Didn’t Log Me Out

Affected Feature OpenAI's "Log out of all sessions" feature. This is supposed to sign you out from every device where you're logged in - web, mobile, everything. How to Reproduce Log into OpenAI on desktop browser and mobile app with the same account On desktop, click "Log out of all sessions" in account settings Wait about 30 minutes Open the mobile app You're still logged in - no re-authentication required Even force-closing and reopening the app doesn't trigger a logout The web session ends properly, but the mobile app session stays active even though you explicitly logged out everywhere. Company Response Reported via Bugcrowd. Marked as duplicate since another researcher found it first, but OpenAI confirmed and fixed the issue as of June 4, 2025.
Post a Comment
Read more

Snapchat Public Profile Information Auto-Saves Without Confirmation

Affected Feature Public Profile editing section, specifically the email and location fields. This is where users manage what personal information appears on their publicly visible Snapchat profile. How to Reproduce Open Snapchat and go to your Public Profile Tap to edit your email or location Start typing something new Don't press the tick (✓) button Just back out or close the keyboard The app saves whatever you typed anyway, even though you never confirmed it.
Post a Comment
Read more