# Twitter's Vine Source code dump - $10080

Exposed private Docker registry at docker.vineapp.com allowed pulling the vinewww image, leaking Vine source code, API keys and third-party secrets.

- Payout: $10,080
- Severity: high
- Program: Twitter
- Credited: avicoder
- Disclosed: 2016-07-22
- Write-up quality: 7/10
- Original: https://avicoder.me/2016/07/22/Twitter-Vine-Source-code-dump/
- Library page: https://bugbountylibrary.com/r/blog%3Aavicoder-me-2016-07-22-twitter-vine-source-code-dump
- Tags: domain:cloud impact:data-leak kind:bounty platform:blog sev:high tech:docker technique:recon vuln:info-disclosure vuln:misconfiguration vuln:secrets-leak

**Target:** Docker registry (v1 API) at docker.vineapp.com
**Root cause:** A private Docker registry was publicly reachable and used the legacy V1 API, allowing unauthenticated search and image pulls of internal images.
**Steps:**
1. Recon subdomains via Censys.io; find `https://docker.vineapp.com` returning `/* private docker registry */`
2. Identify registry as V1 (not V2); consult V1 API docs for endpoints
3. Query search API endpoint; observe 80+ hosted images
4. `sudo docker pull https://docker.vineapp.com:443/library/vinewww`
5. Run image with interactive shell; `ls` reveals Flask MVC source, API keys and third-party secrets
**How found:** Noticed a supposedly private Docker registry was publicly accessible; prior Docker experience suggested images may contain code/secrets; after failing with V2 endpoints, switched to V1 API documentation to enumerate and pull images.
**Exploitation:** Unauthenticated pull of the vinewww image yielded full Vine source code, API keys and third-party secrets; image could also be run to host a local Vine replica.
**Insight:** Legacy Docker registry V1 APIs expose unauthenticated search and pull endpoints; check Censys/Shodan for registry banners and try V1 paths when V2 fails.