I Found a $90k Remote Code Execution Vulnerability in Google

A security researcher discovered a $90,000 remote code execution vulnerability in Google's developer documentation sites by exploiting a Flask session cookie that contained an unencrypted OAuth client secret. By recovering the client secret from the cookie, the researcher was able to forge valid session signatures and inject malicious pickle-serialized objects, allowing arbitrary code execution through the unsafe pickle.loads() call in the OAuth callback handler.