GoKawiilResearcher finds $90k RCE flaw via leaked Flask secret on Google developer sites
A security researcher discovered that Flask session cookies on developers.google.com embedded Google's own OAuth client_id and client_secret in plaintext, inside a pickle-serialized payload. The researcher found that this same client_secret also functioned as the Flask app's SECRET_KEY, meaning anyone who extracted it could forge valid session cookies and execute arbitrary code across seven Google domains. Google reportedly paid a $90,000 bounty for the finding.