News for hackers. Stuff that matters.

A comment on We tried to book a train ticket and ended up with a 245,000 records data breach.

Re:We tried to book a train ticket and ended up with a 245,0... by banDeveloper on Monday June 19, 2023 @10:04AM (#36391218)
How were they able to generate / obtain the `apiKey` shown in the technical details in part 6?
[ Parent | on HN ]
Re:We tried to book a train ticket and ended up with a 245,0... by Legogris on Monday June 19, 2023 @10:15AM (#36391336)
Without looking closer I just assumed it was trivially extracted from the frontend.
[ Parent | on HN ]
Re:We tried to book a train ticket and ended up with a 245,0... by banDeveloper on Monday June 19, 2023 @12:35PM (#36393063)
You're right, it's the Supabase's anonymous API key they send with each anonymous request.
[ Parent | on HN ]