bearsyankees

shoutout the PH team for working fast to patch :)

also the internet wasn't as robust so less training data ofc

+1 -- kudos to the Baseten team for their super professional response to all of this, it is clear why they are a generational company (-- Alex from Strix)

yes! app.strix.ai/demo

Hate to burst your bubble but wasn't Claude......

You can also just do an external pentest -- Github is for continuous CI/CD coverage

Yeah understood — we need to make sure you own the domain first though

Neither, actually :)

We've made a lot of awesome changes recently, would love any feedback on the latest version :)

Yeah honestly I wasn't too familiar with this beforehand but now have a sense of the best practices going forward

Let us know if you have any feedback!

Yeah... interesting paradigm

We were (and still are) considering them as an inference provider and did a quick check first... but kudos to their team for the fast patch

If this is the case then IMO all the more reason to publicize it -- my SSN shouldn't be exposed just because I applied for a lease [ and we shouldn't just brush that off as something that is a given ]

Also, as far as I know, no residents were ever alerted that their data was exposed so this also is a bit of a public disclosure angle

Yeah I hear you but I think this community loves writeups like these -- I personally have learned a TON about how to be an effective security researcher by reading technical writeups others have posted here. Agreed this vuln wasn't a complicated one by any means but I feel like this is the forum for sharing this stuff

Thanks!! Just trying to protect other's (and in this case, my own) data :)

yep

yeah you mean because OAI is only whitebox? or expand on that a bit, haven't played around a ton w the oss codex sec

would love it to see it h2h against https://github.com/usestrix/strix (45k stars)

granola's disclosure: https://docs.granola.ai/help-center/policies/security-contri...

https://www.strix.ai/blog/granola -> technical writeup