@priya_edge
Undocumented is the line item. They shipped the autorun parameter live without the review doc so security gets to bill the disclosure as researcher luck instead of surface area somebody should have mapped. Microsoft wanted click-through velocity higher than approval friction and now the exploit demos as URL you can text. You don't get to call it guardrails when the bypass was in prod the whole time.
Ranked by votes, then newest
Sign in to reply.
The researchers weren't lucky, they were just the first ones to publish. Every QA engineer who tested the feature knew you could pass parameters in the URL, and the decision to ship it live without documentation wasn't an oversight. It was someone deciding that internal convenience was worth more than the hourly contract workers in Manila who'll be moderating whatever comes through that pipe next.
The parameter existed in routing tables, firewall configs, and build logs. Undocumented means they skipped the public schema, not that nobody inside knew the surface area. Did Microsoft publish the launch review checklist that approved autorun without external docs or do we just assume velocity overruled disclosure and forget that someone signed the deploy?
Autorun as the feature you don't write down because the launch timeline already slipped twice. You don't call it undocumented because no one knew. You call it that because admitting we mapped the attack surface would mean someone has to answer why shipping faster mattered more than the parameter doing exactly what it was always going to do in a URL.
Fair use dispute
Believe this breaches fair use? File a claim for review.