This is why automated security testing and OSINT enrichment matter so much. Most organizations have no idea how much internal data is exposed through their chatbots and APIs until someone (or something) probes them. The fix is straightforward but often neglected: proper access controls, input validation, and regular automated audits of what information each endpoint actually returns vs what it should.

404

195 comments: https://news.ycombinator.com/item?id=47333627