R.K
Software has a major security leak they have known about for over a year without fixing it!
On Oct. 8, 2021, I entered a ticket reporting a security leak. Info ticket (with extra info): ---- I would like to draw your attention to a huge security leak in the private photo section. All saved photos (public and private photos) are all directly accessible with or without logging into your account and without the knowledge of the owner of the private photos. All photos are in the folder: website/_files/photo with format xxxx_yyyy_zzz.jpg (xxxx=username, yyyy=order number photo and zzz=photo format thumbnail or full photo etc. So a member can view another member's photo and already have the __scr.jpg photo of a member (reading HTTPS page in browser with F12 for Chrome). Then the member can release a batch to retrieve all _0000_scr.jpg up to _9999_scr.jpg photos. All these files are publicly retrievable without having to be logged in. Therefore, these photos are also traceable to a particular member of the site (privacy breach under the GDPR law. This is a major security leak and should be addressed immediately because the privacy of the members is at stake. Solution would be to make the folder website/_files/photo only readable for logged in users and only those photos to which the member is entitled. Also, the format of the photos should not be traceable to specific members. So photo files not in xxxx_yyyy_zzz.jpg format but in .jpg format thinking of something like "hF!y3Ddc5I$x3#V&8*s2.jpg" format or something similar. I would like to hear what measures Websplosion is taking to close this leak. ---- *** Many more ticket info followed *** Once again had to edit review due to poor responses from Websplosion. Removed my proof tickets from this review on due to the 4000 characters possible in reviews. But proof tickets can be requested from me if people want to. Responses to Websplosion: March,7 2023, 21:56 CET. 1) To post personal name, address and URL of a reviewer here hoping the person feels threatened and removes the bad review does not help, it shows your weakness and a complaint has been filed with TrustPilot for this too! 2) Whether I would be transgender or not doesn't matter at all, don't feel attacked on that either. I only work for this community because I stand up for them! 3) Your software is tested and you never find out all the bugs in the software in a trial period. A security audit by a company uncovered your security leak after the software had already been in use for a year. We informed you of this over a year ago and you did and do nothing about it. 4) In Europe other than where the software builder comes from, there are fortunately strict AVG/GDPR laws that must protect people on the Internet (even their photos), as well as in the USA through the CLOUD act. 5) We talk to you about your security leak, but instead of putting effort into the security leak you threaten and post private data. 6) We got rid of your software because the AVG/GDPR regulations simply do not allow us to use it. 7) Modification of the software is THE LAST THING we want so this review is also NOT at all meant to reinforce anything and that we would hope that the software would then supposedly have to be modified for free. We never asked that! 8) Security leaks in software do not require custom adjustments but is an important point for a software company to make these adjustments ASAP. All major software companies like Microsoft, Google, Apple, etc lean on reports that users give to make their products more secure. 9) Most important: We want to warn other users of this software with a security leak that it is not allowed in Europe because of the leak (GDPR regulations). And yes! We now have reports standing out to the necessary legal authorities, simply because we are legally obliged to do so. We are not kept informed about this (it's out of our hands) and it will take some time, but we are sure that the right legal steps will be taken and the burden of proof has been transferred through the tickets. The fact that the review is continuously updated is due to the fact that you guys are trying to twist things around and distract attention from the real issue: The software has security issues that are not allowed in the EU within the GDPR and the USA with the CLOUD act! Get that you are not happy that the security leak was described here (and other places) among others, but instead of attacking the reviewer, put the time and effort into securing your product for other users. Extra added: Websplosion has its registered address seated in Wyoming. Just figured out that all companies are also subject to "Wyoming's Genetic Data Privacy Act" which is active as of 7-1-22. Just now you have exhibited my private data here which is known in confidence in your company and whose publication is of no use. Therefore also just filed a complaint there for violation of that law.
Response from Websplosion Dating SoftwareNov 12, 2025
Hello, this issue seems to have been corrected in 2023: https://chameleonversions.com/viewtopic.php?f=22&t=227 (at the bottom of the page). Thanks a lot for bringing this to our attention!



