Thread by @fs0c131y

I found the Twitter API key and the Twitter API secret key of "someone famous". What can I do with it?

And by famous I meant famous af

I only have the keys not the tokens.

And yes this is the @realDonaldTrump keys

According to the Twitter documentation with the keys you can:
- Pull user timelines
- Access friends and followers of any account
- Access lists resources
- Search Tweets

I can alo create a rogue Donald Trump Twitter application

developer.twitter.com/en/docs/basics…

Not the end of world but still funny 😅

I don't want to write this email play.google.com/store/apps/det…

People tend to be little be crazy when we talk about Trump, so I might need to say it again. This is not a big deal and if there is a problem it’s probably a minor issue.

Per the Twitter doc, it « doesn’t include any user context » and « read-only access to public information »

The only threats I can see is:
- Use their paid quota
- IF the access token given by Twitter is used to discuss with their own api, create a rogue app