alt Hacker NewsDo you think Lovable would be transparent as to the extent of the problem? Or would they use terminology like “a small subset of our users” and “data not including card details” or whatever to minimize the issue.
I’d much rather live in a world where independent researchers can figure out the extent of the issue rather than go “uh oh there might be an issue here, guess we’ll never know the extent of it, let’s trust them to fix it”.
That's a good question. But it is a very fine line between being a white hat that reports a vulnerability in good faith and someone who actually exploits that vulnerability and turns a vulnerability report into an actual breach. This is - in my opinion, clearly the HN hive mind disagrees - across that line.
For instance, if I run into a server and I see 'passport.jpg' in a directory listing I could download it to see if it really is a passport. But at that point in time I am flirting with becoming a defendant in a data breach rather than that I'm reporting a possible vulnerability. Sure, you could argue that the site owner might close the hole and then they could downplay that it really was a passport photograph. But I care more about the hole being closed than that I care about the contents of the file, which clearly are not meant to be disclosed based on the filename alone.
Independent researchers that are under contract with the companies they review sometimes have more leeway in what they are allowed to do. But downloading enough data to be able to run statistical analysis using LLMs is turning this into a reportable breach and that is a great way to get this whole thing to backfire, possibly to the point where the OP turns defendant.