Whatever people have paid for, it is not the engineering capability.

Click through to the entire thread because it is all worth a read and has several updates.

I don’t know who needs to hear this but #TruthSocial, which is running a forked version of Mastodon, does not from the source code appear to have appropriate mitigations in place for CVE-2023-36460, which theoretically allows attackers to create and overwrite any file Mastodon has access to, allowing Denial of Service and arbitrary Remote Code Execution https://nvd.nist.gov/vuln/detail/CVE-2023-36460 (probably other CVE’s as well, but some rely on federation which Truth Social doesn’t use?) #infosec

https://digipres.club/@ryanfb/112146904149736275