Uber: developer.uber.com/404 and developer.uber.com/docs/404 are susceptible to iframes

Issue You can iframe the error pages for https://developer.uber.com/404 and https://developer.uber.com/docs/404 Proof of concept An example can be found here http://codepen.io/JacobReynolds/pen/VaMbde?editors=1010 Impact There is not a large security impact from a cursory glance at the 404 pages...

Uber: Lack of CNAME/A Record Trimming Pointing Uber Domains to Insecure Non-Uber AWS Instances/Sites

Limited disclosure at @jutsuce's request...