the hacker news comment section is like the neurodivergence olympics, and Concern is its premiere sport

around jacquesm's insistence that this is a breach.

I mostly see an accusation of downloading more data than needed to prove the point.

While you are technically correct, in practice the democratizing of a tool that can be consequential in leaking your private information should come with stronger safeguards and educational opportunities for those who aren’t well versed in technology.

Lovable lets you do stuff without even understanding semantically what API or API Key means and how it can or should be used.

Moving too fast and putting the onus at the user is a bit shady.

This is obviously misleading. You're answering a specific question with an opinion on something else.

We used to call this spam.

I don’t understand what you’re saying, sorry.

My point was to say how AI tools can quickly build insecure software systems.

Am I wrong that shipping a key publicly in the client side is not something a tool should try to check for?

You're sharing a perfectly valid opinion that I happen to agree with. However, you did so in reply to a very specific question — someone asking why jacquesm (a well-known poster on HN) — considers the actions described in the article a data breach rather than merely security testing. Your comment had nothing to do with that. That's all!

oh, I think I glossed over that distracted and flew past me; that makes sense reading it over again

Sure.

I think it really depends on the data itself and jurisdiction. There's very real chance just having more data than you need to prove the exploit exists could open you up for potential legal liability (especially if the data itself is sensitive). Imagine a situation where the researcher gets compromised after the fact with sensitive data lingering around on their machine.

Hasn't there been cases where people got charged for unauthorized access to computer system by simply changing some identifier in the URL?

Data being technically accessible doesn't mean it's meant to be accessed by anyone.

If I understand this right, this is the equivalent of leaving a house key hidden under the doormat. Just because it can be easily found doesn't mean anyone's just legally allowed to use it.

Well, there was. But inputting or editing a url is akin to submitting a form or a get request, if somebody doesn't know how to not get breached by such events, they have no business running a website with delicate data

If I don't even install door locks I have no business running a security company, that is true, and also, it's still illegal to break in.

Yeah. If I remember correctly it was 'weev' and something to do with AT&T.

He seems a hard person to have sympathy for, which didn't help that much at all.

[delayed]

The precise term is 'inadvertent disclosure'.

https://csrc.nist.gov/glossary/term/inadvertent_disclosure