How I Found a Critical 9.8 Bug — Directory Listing leads to Critical P1 Exposure of PII and more

A bug is never just a mistake. It represents something bigger. An error of thinking that makes you who you are.

You know what’s funny about society? We build these massive digital fortresses, implement countless security measures, spend millions on cybersecurity — and yet, the most devastating vulnerabilities are often hiding in plain sight, like a glitch in the matrix that nobody bothered to notice.

I discovered this while probing a major automotive company’s website. Not the glossy front-end where they showcase their latest models, but in the shadows — a forgotten, neglected section of their digital infrastructure. These overlooked corners are where the real weaknesses lie, where corporations get sloppy.

The initial discovery was almost disappointing in its simplicity. Directory listing — a basic reconnaissance technique that even script kiddies know about. There was an admin panel, sure, protected by their precious password authentication. But corporations always make the same mistake: they focus on protecting the front door while leaving the windows wide open.