Cloudflare was disclosing a lot of private data, including login passwords and authentication cookies.
Uber, Fitbit, 1Password, and OKCupid are just a few of the big names affected by the Cloudbleed security flaw in Cloudflare servers.
Because mobile apps are created with the same backends as browsers for HTTPS (SSL/TLS) termination and content delivery, they are likewise impacted by Cloudbleed.
The fact that Cloudflare directed Ormandy to the company's bug bounty programme and offered the expert a t-shirt as payment in lieu of cash is highly unusual.
Source: https://securityaffairs.com/56617/data-breach/cloudbleed-cloudflare-flaw.html
"id": "CLO619191123",
"linkid": "cloudflare",
"type": "Breach",
"date": "02/2017",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"