HOW I FOUND A $90,000 REMOTE CODE EXECUTION VULNERABILITY IN GOOGLE

Summary from the TLDR Dev newsletter

Google's DevSite stored an OAuth secret inside a readable Flask session cookie and reused it as the cookie's signing key, allowing forged sessions to reach unsafe pickle deserialization. Timing-based tests confirmed unauthenticated code execution across the shared platform, earning a $90,000 bounty. The fix separates signing keys from OAuth credentials and removes sensitive serialized objects from client-controlled sessions.