https://blog.ryankempt.com/tags/secure-disclosure/ Recent content in Secure Disclosure on Ryan Kempt // blog Hugo en-us Fri, 25 Sep 2026 00:00:00 +0000 https://blog.ryankempt.com/posts/hardening-cipp/ Fri, 25 Sep 2026 00:00:00 +0000 https://blog.ryankempt.com/posts/hardening-cipp/ <p>On July 14th, I found an <strong>unauthenticated</strong> path in <a href="https://cipp.app/">CIPP</a> to a <a href="https://partner.microsoft.com/">Partner Center</a> token (the control plane that sits <em>above</em> every Microsoft 365 tenant an MSP manages). I wrote up a casual security disclosure to the CyberDrain Security Team, and sent it off. Twelve minutes later I had a reply from <a href="https://www.linkedin.com/in/kelvintegelaar/">Kelvin Tegelaar</a>. Thirty-one minutes later there was a downloadable patch and every MSP running CIPP was getting the patch.</p> <p>I reported it and forty-three minutes later the fix was merged, versioned, and downloadable.</p>