List Names in Mobile App Acknowledgement?

[KatieAnn]

When I go into my app and go to acknowledgments, I have what looks like a long software code and potentially lists other customer emails and names, does anyone else have that? It seems this is confidential data against the CCPA.

I’d love to report it to Tesla but I can never get a person, any recommendations?

 

[srs5694]

Tesla has a bug bounty program, described briefly here. I suggest you fire off an e-mail to the address listed on that page, including screen shots of the Tesla app showing the information you describe; and/or file a report on the BugCrowd page that Tesla's page references. (It looks like you'll need to create an account on BugCrowd to use that method.) FWIW, I've never done either of these things, so I don't know much about them beyond the initial entry points. Tesla's bug bounty program may be oriented toward people with a high degree of technical expertise; but at least a report through this channel should catch somebody's attention. If the Tesla app is leaking other customers' data, then that certainly qualifies as a security risk.

 

[Minbari]

If you're looking in the Acknowledgements tab, that isn't customer emails and names, nor is it a bug.

These are individual acknowledgements of different software developers, github repositories and packages that Tesla is giving credit for using in their app.

You'll notice each of the entries generally includes the name of the software package/library/tool/etc, followed by their name, email address or website link.

This is an intentional "feature" of the app to credit those authors with their work, and has been in the Tesla app for a long time.

There's no "security risk" or anything here, this isn't confidential data or anything that violates CCPA. You don't need to bother contacting Tesla or reporting a bug unless somehow your Acknowledgements page isn't the same as everybody else's - maybe you can look up some images online of what the feature is supposed to look like - it's intentionally designed that way, and using a font that "looks" like code might. Overall it's a neat easter egg as a nod to the developers, and not much more.

 

[jjrandorin]

(moderator note)

I changed the thread title, because the email addresses and names in acknowledgements looks to be intentional (and not customer data), as what @Minbari mentions.