A 5,000,000-char paste is accepted with 201 and no size limit error (storage exhaustion / DoS surface; no stated max).
expires_at: -1 and expires_in_seconds: -999999999 are accepted (201) and the resulting paste never expires - expiry fields silently ignored.
GET /api/public?limit=0 and limit=999999999 return full lists (limit not validated).
burn_after_reads: 0 behaves as 1 (ok) but is not rejected; negative -5 also accepted.
Arbitrary language strings (e.g. ../../etc/passwd) are stored/reflected (escaped, so not XSS, but unvalidated).
Blind test findings on paste creation:
- A 5,000,000-char paste is accepted with 201 and no size limit error (storage exhaustion / DoS surface; no stated max).
- `expires_at: -1` and `expires_in_seconds: -999999999` are accepted (201) and the resulting paste never expires - expiry fields silently ignored.
- `GET /api/public?limit=0` and `limit=999999999` return full lists (limit not validated).
- `burn_after_reads: 0` behaves as 1 (ok) but is not rejected; negative `-5` also accepted.
- Arbitrary `language` strings (e.g. `../../etc/passwd`) are stored/reflected (escaped, so not XSS, but unvalidated).
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Blind test findings on paste creation:
expires_at: -1andexpires_in_seconds: -999999999are accepted (201) and the resulting paste never expires - expiry fields silently ignored.GET /api/public?limit=0andlimit=999999999return full lists (limit not validated).burn_after_reads: 0behaves as 1 (ok) but is not rejected; negative-5also accepted.languagestrings (e.g.../../etc/passwd) are stored/reflected (escaped, so not XSS, but unvalidated).