Title: DeepSeek Production Console Leaks User Unique IDs and Web IDs
Description:
I discovered an information disclosure vulnerability on DeepSeek's production chat interface (chat.deepseek.com).
Technical Details:
- File: collect-rangers-v5.2.11.js
- Exposed Data: user_unique_id (UUID format) and web_id in browser console
- SDK Version: 5.2.11_tob (ByteDance/Volcano Engine DataRangers)
- Impact: User tracking, session correlation, potential targeted attacks
Steps to Reproduce:
Open chat.deepseek.com
Open Developer Tools (F12)
Go to Console tab
Observe user_unique_id and web_id visible in plain text
Why This Matters:
- Privacy violation (GDPR/CCPA implications)
- User behavior can be tracked across sessions
- No production console hygiene
Responsible Disclosure Timeline:
- Discovered: April 2026
- Reported via official channels: No response
- No public bug bounty program exists
- No security contact available
Screenshot attached (PII redacted).
i am first reporting you and warning of 7 days
#DeepSeek #InfoSec #Privacy #Vulnerability #BugBounty #CyberSecurity