Vendor SRC Acknowledgments

Reports submitted through private vendor Security Response Center (SRC) programs. These portals — Kuaishou SRC and JD SRC — have no public per-report URL, so each entry links to a screenshot of the platform’s own vulnerability-detail page, showing the vendor’s confirmation and acknowledgment of the report (status such as Confirmed or Under repair), viewable without an account. Broader manual bug-bounty history (Bugcrowd: 8 validated vulnerabilities, 100% accuracy, Hall of Fame) is linked from the About page.

• Canvas project allows forcibly adding arbitrary users as collaborators without consent Kuaishou SRC · Kling AI (可灵AI) 灵动画布
  Low 2026-08-07
• Internal /dev/kconf-editor tool exposed to any logged-in user, leaking internal KConf write interface Kuaishou SRC · Kling AI (可灵AI) Developer Console
  Low 2026-08-07
• Claw Login device-authorization flaw (no consent issuance + unauthenticated retrieval) enables one-click credential theft Kuaishou SRC · Kling AI (可灵AI) Claw Login
  High 2026-08-06
• executeByApiId billing-logic vulnerability (race condition + missing quantity validation + balance-check bypass) JD SRC · JD Cloud LingJing AI (京东云灵境AI)
  Medium 2026-07-27