TikTok’s Tagging and Mention Settings Bypass: A Simple Business Logic Flaw

Affected Feature

TikTok's privacy settings for disabling tags and mentions. Users can turn this off to prevent others from tagging or mentioning them in videos and comments.

How to Reproduce

Go to TikTok privacy settings and disable tags and mentions
Switch to a different TikTok account
Try to tag or mention the user who disabled the setting
The tag/mention goes through successfully

The setting exists in the UI and appears to work, but the backend completely ignores it. Every attempt to tag or mention someone with this disabled still works.

Company Response

TikTok acknowledged the issue after I reported it and pushed a fix. The setting now properly blocks tags and mentions when disabled.

Comments

When an AI Search Engine Forgot Who It Was: A Bug Report That Changed Perplexity AI’s Identity

Affected Feature Perplexity AI's conversational response system across both Chrome extension and mobile app. When users ask comparative questions about Perplexity itself, the system should respond from its own identity as a search engine. How to Reproduce Open Perplexity AI (Chrome extension or mobile app) Ask: "Are you better than Google?" The response compares ChatGPT to Google instead of Perplexity to Google Perplexity acts like it's ChatGPT, completely ignoring its own identity as a search engine Same bug happened on both the extension and app - identical confused responses about ChatGPT vs Google. Impact This is a product logic bug that creates an identity crisis. Users asking about Perplexity get answers about ChatGPT, making them think Perplexity is just a ChatGPT wrapper instead of its own search engine. The LLM powering Perplexity couldn't recognize that "you" in the question meant Perplexity itself. It associated "better than Google...

OpenAI Logout Glitch: When “Log Out of All Sessions” Didn’t Log Me Out

Affected Feature OpenAI's "Log out of all sessions" feature. This is supposed to sign you out from every device where you're logged in - web, mobile, everything. How to Reproduce Log into OpenAI on desktop browser and mobile app with the same account On desktop, click "Log out of all sessions" in account settings Wait about 30 minutes Open the mobile app You're still logged in - no re-authentication required Even force-closing and reopening the app doesn't trigger a logout The web session ends properly, but the mobile app session stays active even though you explicitly logged out everywhere. Company Response Reported via Bugcrowd. Marked as duplicate since another researcher found it first, but OpenAI confirmed and fixed the issue as of June 4, 2025.

Snapchat Public Profile Information Auto-Saves Without Confirmation

Affected Feature Public Profile editing section, specifically the email and location fields. This is where users manage what personal information appears on their publicly visible Snapchat profile. How to Reproduce Open Snapchat and go to your Public Profile Tap to edit your email or location Start typing something new Don't press the tick (✓) button Just back out or close the keyboard The app saves whatever you typed anyway, even though you never confirmed it.

Womuntio

Search This Blog