[halflings]

I hope it doesn't get unnoticed that the guys who discovered this vulnerability created a really great product, Detectify :

https://detectify.com/

They also discovered vulnerabilities in many big websites (dropbox, facebook, mega, ...). Their blog also has many great write-ups : http://blog.detectify.com/

[detectifyuser]

While they are probably good at doing this manually, their automated tool finds very little. And they were kind of assholes on support :(

[detectify]

Sorry to hear that you are disappointed. Few results can be a good thing though, it might just mean that your site has very few issues! Feel free to mail us again and thanks for the feedback :)

[opendais]

Odd, I had the opposite experience. They seemed fine to me.

[ibu]

Nice try, Tinfoil.

[borski]

Er...CTO of Tinfoil here. We respect the Detectify guys a lot. Not sure what you were trying to get at, but there's no conspiracy here. We don't engage in subversive competitive tactics.