alt Hacker NewsDon't you think you should have reported this after you established the principle rather than to download more than you needed to do so? Because it looks to me as though you went from 'white hat hacker' to 'quite probably criminal' without a really good reason.
Replies
How do you know which websites are affected without sampling data from each website in question? As the blog explains, it's safe to serve public data from Supabase in this manner, so the only way to determine whether the website has an issue is to look at the actual records they are serving. Their approach seems entirely reasonable to me.
As someone who has dealt with vulnerability reports on products before, I'd strongly prefer getting concrete proof of an issue versus "your product came back as positive on our vulnerability scanner^tm" which is 99% of the time going to be a scam or a waste of time.
I should also mention that the analysis was conducted in collaboration with a lawyer specializing in data protection and ethical hacking.
What do you mean? This has been disclosed to, and the full dataset has been shared with, Lovable.
When it comes to law, you're obviously punching about your weight.
I know you're casual on this, but I wanted to chime in to help you learn a thing or two about this (and to do a service to other who might also be oblivious).
Nothing neathack did was illegal, taking it at face value, of course.
Furthermore, he disclosed it responsibly, didn't publish any confidential data, etc,; actually he published no data at all, other than a statistic.
Criminal law deals with intent, it is clear that neathack's intent here was fueled by goodwill and a research purpose. No judge on the planet will look at this and find wrongdoing on his side.
Also read the room, everyone here has told you the same thing ... just say thanks and move on, man.
the concern trolling discourse of hacker news strikes again
Do you think Lovable would be transparent as to the extent of the problem? Or would they use terminology like “a small subset of our users” and “data not including card details” or whatever to minimize the issue.
I’d much rather live in a world where independent researchers can figure out the extent of the issue rather than go “uh oh there might be an issue here, guess we’ll never know the extent of it, let’s trust them to fix it”.