If I recall last week Mintlify wrote a blog post showcasing their impressive(ly complicated) caching architecture. Pretending like they were doing real engineering, when it turns out nobody there seems to know what they're doing, but they've managed to convince some big names to use them.
Man, it's like everything I hate about modern tech. Good job Eva for finding this one. Starting to think that every AI startup or company that is heavily using gen-ai for coding is probably extremely vulnerable to the simplest of attacks. Might be a way to make some extra spending money lol.
Is there any indication Mintify was "vibe coded"?
The challenge with security, as you know, is it's only as strong as it's weakest link. It only takes one ignorant/incompetent person in an entire organization to jeopordize the org.
In practice, I've never known a single organization to hit that bar. Ever.
https://kibty.town/blog/mintlify/
The first CVE here definitely sounds like they absolutely weren't thinking care security.
Yes, but the vulnerabilities reported in this collection of articles really smell like trash. Allowing untrusted code from your customers to be executed in a shared environment with no isolation is like, extremely amateurish.
Are you saying tho that 2.5k wouldhave been adequate in 2019? I expect 5k would have been on par then too. But idk
We pwned X, Vercel, Cursor, and Discord through a supply-chain attack
The result? A static html with 500 ppl audience was billing a whooping 2k EUR a month, because that was the cost of that pre-approved architecture.
Best part - I was championing a company wide solution for that problem for over a year, which resulted in board level special operation with 100k budget only to get that budget snugged by people couple steps above the ladder.
But it looks like Mintlify are using Vercel on the backend: https://vercel.com/blog/mintlify-scaling-a-powerful-document...
So it's just a Vercel wrapper?
What??
Also, if users can run arbitrary JS on someone else's server then what stops them from doing CPU-bound work such as crypto miners?
ddtaylor•1mo ago