DoorDash email spoofing vulnerability sparks messy disclosure dispute

A security researcher discovered a stored HTML injection in DoorDash for Business that allowed anyone to create employee entries and send fully branded DoorDash emails from [email protected], enabling highly convincing phishing messages; the issue was later patched after a prolonged disclosure dispute between the researcher and DoorDash that involved demands for payment and the researcher's removal from the bug bounty program, and the flaw did not expose customer data or internal systems.