“with this, i could push auto updates to all applications using todesktop”
A postinstall script gave a researcher a shell inside ToDesktop’s build server, next to the keys that push updates to Cursor, Linear, Notion Calendar, and ClickUp. One bug could have shipped code to every machine running them. ToDesktop paid $5,000. Cursor, its customer, paid $50,000.