Tea app leak worsens with second database exposing user chats

Re:Tea app leak worsens with second database exposing user c... by frollogaston on Tuesday July 29, 2025 @12:45PM (#44725588)

It's hard to screw up Postgres to the extent that your entire DB is made fully accessible by all users. This has happened many times with Firebase apps, for over a decade.

You could have a SQL injection vuln, but any SQL lib will very clearly steer you to parameterized queries, and even then such a vuln takes some expertise to find and exploit.

[ Parent | on HN ]

Re:Tea app leak worsens with second database exposing user c... by moomoo11 on Tuesday July 29, 2025 @02:40PM (#44726877)

That’s simply not true. I remember working with a startup founder who had Jerry rigged some crap shit together with gpt a year ago.

I was able to access his data by simply accessing it figuring out his URL and other stuff. I told him to use supabase or DO deployment and set up proper roles and stuff…

I think you’re being way too charitable honestly and it’s dangerous. I won’t join you on that path of absolving the developer of any blame.

They don’t read the docs and they didn’t care simply put. Any production system needs to be tested especially if it will have PII data.

[ Parent | on HN ]

Re:Tea app leak worsens with second database exposing user c... by frollogaston on Tuesday July 29, 2025 @02:46PM (#44726930)

Don't get me wrong, there is still such a thing as a bad dev. If this startup founder actually wrote an entire app using GPT and it had such vulns, I'm pretty sure he'd mess up the Firebase ACLs too.

[ Parent | on HN ]