When the Walls Aren’t as Secure as They Seem: My Instagram Discovery

On Saturday 9 November 2024 I’ve reported an issue with Instagram to Meta, an issue that involves both security and privacy. While I can’t reveal the details just yet, I want to provide some context about what I found, the progress so far, and where things are heading.

Four months ago, I noticed something unusual on Instagram regarding how archiving posts worked. After testing deeper, I realized it could be a bigger issue than initially thought. So, I reached out to Meta’s security team to report the findings. My discovery touches areas of security and privacy that could impact how user data is handled, both on the surface and under the hood.

Without diving into specifics (I’ll leave that for later), the core of the issue revolves around how data that has been made unavailable by specific users on the platform could still be accessible to some of their network.

Once I confirmed the issue, I accumilated the technical evidence and reached out to Meta’s security to report the vulnerability. Since then, I’ve share the requested additional information sought by them and been cooperating with them to ensure it’s thoroughly investigated.

It’s been a slow process, but a part of the journey when it comes to responsible disclosure.

I’m committed to being transparent and sharing what I’ve learned in the hopes of contributing to better security practices across platforms like Instagram.

I plan to post an update as soon as there’s a significant development or resolution. Any immediate updates will be posted on my X thread