I may not be the intended audience, but as the author of a similar system having a benchmark like this of what user behavior can result in when it’s unconstrained is helpful for my safety evals. So in an indirect way, you’re making future platforms more secure by sharing this.
replyThat's great to hear!
replyYou probably should not have done that. It's one thing to determine that a hole exists, an entirely different one to exploit it to the point that you can do damage assessment on the target.
replyWould you prefer someone that didn't intent to report but to exploit the data downloaded everything and the company and you knew fuck all about it?
replyThat's not the only choice available.
replywhy don't you chill the fuck out. you've been harassing the op over and over here
replyI think you should take your own advice.
replyWell, it seems that no amount of explanations will satisfy you, so I would say you're the one pushing for a binary choice scenario. Hard...
replySo I can, maybe, understand your posture: what are your ties to Lovable?
replyNone whatsoever. What kind of a dumb question is that?
replyYou seem to be insanely hellbent on implying the actually worst possible intent to the researcher who acted in the good faith and contacted the vendor aiming for the quickest and best fix.
replyIt looks like you're weirdly trying to inflate a legitimate attempt to confirm if the severity of the exposure is as bad as suspected into a full blown nasty data thief.
This is why everyone is so puzzled. You're genuinely harassing op for doing a good thing and responsibly reporting the severe security problem.
I haven't made a single statement about their intent.
replyI have just pointed out that there is a difference between reporting a vulnerability and actually exploiting that vulnerability.