“Immediately upon learning this information, we took several steps to review the situation and bring in the right external partners to support our investigation.” Some of the claims were false extortion attempts, Ballou said, but the company “did identify and fix a vulnerability that was related to the ability to access source code through an injection vulnerability.” I’ve reached out to Friend Finder and will update this story if I hear back.