I cannot wrap my head around jacquesm's insistence that this is a breach.
Can someone please correct me if I'm wrong here, but isn't the article claiming that all data was publicly accessible with a read-only API key, also publicly shipped in each site?
Unless I'm missing something, no amount of digging into *published* data is a breach of anything. The act of publishing it is the leak, not the consumption.
While you are technically correct, in practice the democratizing of a tool that can be consequential in leaking your private information should come with stronger safeguards and educational opportunities for those who aren’t well versed in technology.
Lovable lets you do stuff without even understanding semantically what API or API Key means and how it can or should be used.
Moving too fast and putting the onus at the user is a bit shady.
You're sharing a perfectly valid opinion that I happen to agree with. However, you did so in reply to a very specific question — someone asking why jacquesm (a well-known poster on HN) — considers the actions described in the article a data breach rather than merely security testing. Your comment had nothing to do with that. That's all!
I think it really depends on the data itself and jurisdiction. There's very real chance just having more data than you need to prove the exploit exists could open you up for potential legal liability (especially if the data itself is sensitive). Imagine a situation where the researcher gets compromised after the fact with sensitive data lingering around on their machine.
Hasn't there been cases where people got charged for unauthorized access to computer system by simply changing some identifier in the URL?
Data being technically accessible doesn't mean it's meant to be accessed by anyone.
If I understand this right, this is the equivalent of leaving a house key hidden under the doormat. Just because it can be easily found doesn't mean anyone's just legally allowed to use it.
Well, there was. But inputting or editing a url is akin to submitting a form or a get request, if somebody doesn't know how to not get breached by such events, they have no business running a website with delicate data
Can someone please correct me if I'm wrong here, but isn't the article claiming that all data was publicly accessible with a read-only API key, also publicly shipped in each site?
Unless I'm missing something, no amount of digging into *published* data is a breach of anything. The act of publishing it is the leak, not the consumption.
Am I losing the plot?
I mostly see an accusation of downloading more data than needed to prove the point.
Lovable lets you do stuff without even understanding semantically what API or API Key means and how it can or should be used.
Moving too fast and putting the onus at the user is a bit shady.
My point was to say how AI tools can quickly build insecure software systems.
Am I wrong that shipping a key publicly in the client side is not something a tool should try to check for?
Data being technically accessible doesn't mean it's meant to be accessed by anyone.
If I understand this right, this is the equivalent of leaving a house key hidden under the doormat. Just because it can be easily found doesn't mean anyone's just legally allowed to use it.
He seems a hard person to have sympathy for, which didn't help that much at all.
https://csrc.nist.gov/glossary/term/inadvertent_disclosure