KOKomoD·Jul 3, 2026
> We attempted responsible disclosure by emailing dev@ajay.app multiple times on July 3 and 4, 2026, but received no response.
SponsorBlock is run by one guy. I consider this very irresponsible. You barely waited, and accessing (what you consider to be) the private data of 82k users is not at all necessary to prove a vulnerability. Luckily, most of these aren't really vulnerabilities.
But I'll go over the claims:
> This allowed us to enumerate and download almost the entire user database.
No. Sponsorblock says it has 13 million users, so 82k is not anywhere near "the entire user database".
> 8NpFUCMr2Gq4cy4UrUJPBfGBbRQudhJ8zzex8Gq44RYDywLt3UtbbfDap3KPDbcS
This is not a YouTube api key. It's an api key for a SponsorBlock API route that acts as a proxy to fetch information about a YouTube video.
> AIzaSyA8eiZmM1FaDVjRy-df2KTyQ_vz_yYM39w
Thi
Read the rest
s is an api key accessing some internal YouTube APIs. It's documented in many places and belongs to YouTube Android.
> PostgreSQL connection: postgresql://sponsorblock:pw@127.0.0.1:5432/sponsorTimes
You believe these are real creds?
> Admin password hash, global salt, Patreon integration keys, webhook secrets were exposed in repository files
From the CI and test configs...?
> High - Public Grafana Dashboard
Why do you consider this "High" or "Critical"?
> POST /api/skipSegments and POST /api/voteOnSponsorTime endpoints accepted submissions without proper user verification
This is intentional. The extension generates a UUID and uses that as a user ID.
> Batch queries revealed additional sensitive fields including userAgent.
What is sensitive about these fields? https://github.com/ajayyy/SponsorBlockServer/blob/1dd7a32092...
Sorry to say, but prompting some AI model and forwarding the results does not make you a security researcher.