What would happen when you find an exploit in the Scratch website and use it for, for example, a self-loving project? What would happen? Permanent ban?

you'd be breaking the law.

i think if it was used to demonstrate responsibly (eg. alert('xss!') i think the ST would be ok as long as you're reporting the bug.

if you used it to gather login cookies or something, i think they might be slightly more harsh…


edit, clarifications because this is a bad post:
- do not publicly demonstrate the bug, report it directly to the scratch team and clean up after yourself if your testing left some evidence that others might find.
- do not exploit a bug. that's bad.

Jeffalo wrote:

if you used it to gather login cookies or something, i think they might be slightly more harsh…

Yeah I think so too but where's the border between demonstrating a bug and shamelessly doing questionable stuff?

HTML-Fan wrote:

Jeffalo wrote:

if you used it to gather login cookies or something, i think they might be slightly more harsh…

Yeah I think so too but where's the border between demonstrating a bug and shamelessly doing questionable stuff?

In your scenario, you cant use it to get top loved. But i'd think giving yourself 2-3 hearts would be fine to demonstrate the problem and point it out to the ST.

mtech22 wrote:

HTML-Fan wrote:

Jeffalo wrote:

if you used it to gather login cookies or something, i think they might be slightly more harsh…

Yeah I think so too but where's the border between demonstrating a bug and shamelessly doing questionable stuff?

In your scenario, you cant use it to get top loved. But i'd think giving yourself 2-3 hearts would be fine to demonstrate the problem and point it out to the ST.

Lol if it leaves a love and fav and griffpatch sees it …

you'd get IP and perma-banned.

scratchykit5743 wrote:

you'd get IP and perma-banned.

Why?

If you find a vulnerability in Scratch, please use the Contact Us link to let us know instead of exploiting it. We have a bounty program that we can invite you to, which allows us to fix bugs before they're made public and award bounties to bug-finders. If you publicize a software vulnerability without giving the maintainer time to fix it, even as a proof-of-concept, you open the door to malicious actors using it for harm.