Re:Lovable apps expose passport details and more than 200K p...
by schrodinger on Saturday November 14, 2026 @05:54PM
(#50501876)
The point is that once you realize you're seeing data you shouldn't be seeing, you should either stop and just report it, or save the smallest amount reasonable to demonstrate the issue.
IANAL, but I think it'd be advisable to seek legal advice if you decide to take door number 2 and collect a corpus of evidence to decide what "the smallest reasonable" is; at least put some serious thought into it — because while I have no reason to suspect that neathack had bad intentions, it doesn't seem likely that it was necessary to collect 159k projects to show the scale of the impact.
He could instead have collected a representative sample, and then extrapolate the true size of the impact. I'm not trained in statistics, so don't know how to calculate the required sample size, but I know it's possible.
IANAL, but I think it'd be advisable to seek legal advice if you decide to take door number 2 and collect a corpus of evidence to decide what "the smallest reasonable" is; at least put some serious thought into it — because while I have no reason to suspect that neathack had bad intentions, it doesn't seem likely that it was necessary to collect 159k projects to show the scale of the impact.
He could instead have collected a representative sample, and then extrapolate the true size of the impact. I'm not trained in statistics, so don't know how to calculate the required sample size, but I know it's possible.
Isn't this what you're getting at jacquesm?