| ▲ | neathack an hour ago |
| What do you mean? This has been disclosed to, and the full dataset has been shared with, Lovable. |
|
| ▲ | 32 minutes ago | parent | next [-] |
| [deleted] |
|
| ▲ | jacquesm 39 minutes ago | parent | prev [-] |
| What I mean is: you knew it worked before you went and pulled more data, you could have stopped after the first two records, why pull more than you needed to prove that it was possible? |
| |
| ▲ | neathack 31 minutes ago | parent [-] | | We retrieved only enough data to determine whether it was privacy-sensitive, which could not be reliably assessed from just two records. We did not download any more than that. Supabase tables also use pagination, and we never downloaded more than the first page. | | |
| ▲ | jacquesm 29 minutes ago | parent [-] | | You probably should not have done that. It's one thing to determine that a hole exists, an entirely different one to exploit it to the point that you can do damage assessment on the target. | | |
| ▲ | coldtea 18 minutes ago | parent [-] | | Would you prefer someone that didn't intent to report but to exploit the data downloaded everything and the company and you knew fuck all about it? | | |
|
|
|
