A researcher bought noreply.net. Companies started sending him secrets.
- ID
- 12728
- Status
- summarized
- Published
- 10 Aug 2026, 10:25 PM
- Fetched
- 10 Aug 2026, 11:29 PM
- Provider
- Ars Technica
- Category
- technology
- Original URL
- https://arstechnica.com/security/2026/08/a-researcher-bought-noreply-net-companies-started-sending-him-secrets/
- Source URL
- https://feeds.arstechnica.com/arstechnica/index
Summary
- Score
- 7.5
- Created
- 10 Aug 2026, 11:33 PM
- Tags
- Audience
- developersvibe_codersai_agent_users
What happened
A researcher purchased the domain noreply.net and began receiving automated emails from companies that had hardcoded 'noreply@noreply.net' addresses into their systems, including messages containing secrets like password reset links and API credentials. The article details what was exposed and which companies were affected.
Why it matters
If your app sends automated emails with secrets (reset tokens, API keys, 2FA codes) to a 'noreply' address on a domain you don't control, that domain can expire and be bought by anyone. Audit your codebase for hardcoded sender or recipient domains you don't own, especially common patterns like noreply.net, and switch to your own controlled domain.
Discussion angle
How many of us have hardcoded a 'noreply@noreply.net' or similar throwaway domain in our apps? This is a cheap, easy-to-overlook supply chain risk — worth doing a quick grep across repos for domains in email configs that aren't owned by the project.