How to hack Discord, Vercel and more with one easy trick

74•todsacerdoti•3h ago

Comments

devrupt•2h ago

llmslave2•2h ago

This feels so emblematic of our current era. VC funded vibe coded AI documentation startup somehow gets big name customers who don't properly vet the security of the platform, ship a massive vulnerability that could pwn millions of users and the person who reports the vulnerability gets...$5k.

If I recall last week Mintlify wrote a blog post showcasing their impressive(ly complicated) caching architecture. Pretending like they were doing real engineering, when it turns out nobody there seems to know what they're doing, but they've managed to convince some big names to use them.

Man, it's like everything I hate about modern tech. Good job Eva for finding this one. Starting to think that every AI startup or company that is heavily using gen-ai for coding is probably extremely vulnerable to the simplest of attacks. Might be a way to make some extra spending money lol.

subscribed•2h ago

You bet not all THW vulnerabilities are reported to the vendors. Not with 5k bounty for THAT.

guizadillas•2h ago

Yeah it made me re-evaluate how much I can trust those platforms

llmslave2•2h ago

Yeah thats the scary thing. I know it's a bit of a meme about how as programmers we don't trust other programmers or software, but it's becoming more and more true and necessary. I want to use as little software as possible these days.

dfc•38m ago

THW?

gruez•2h ago

> This feels so emblematic of our current era. VC funded vibe coded AI documentation startup somehow ...

Is there any indication Mintify was "vibe coded"?

llmslave2•2h ago

I'm giving them the benefit of the doubt, as the alternative would be that their developers are completely incompetent. The vulnerability is the equivalent to letting a user save HTML to a database and then injecting it into every page completely unsanitized.

agosta•21m ago

Mintlify had a blacklist in place to not allow them to do this with most file types. Someone failed to add SVG to it. It's not like they weren't thinking about security. The challenge with security, as you know, is it's only as strong as it's weakest link. It only takes one ignorant/incompetent person in an entire organization to jeopordize the org. But even a competent person can make a crucial mistake.

agosta•27m ago

Chill - just because someone got hacked doesn't mean their product is trash. Easily every mass adopted product created prior to 2023 has been hacked at some point.

sans_souse•2h ago

$5k is such a small payout for this sort of finding.

ChrisArchitect•1h ago

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

https://news.ycombinator.com/item?id=46317098

ollybee•1h ago

How is a company like mintlify getting so many big name customers for what appears to be a static site generator + hosting? Is there some secret sauce I'm missing, what is the value proposition?

tommica•1h ago

Convenience and developer uncertainty. I fall pray to the "it's paid, so it must be better" fallacy, and the "they know what they are doing, they are pros" illogicality.

Beginning January 2026, all ACM publications will be made open access

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

GPT-5.2-Codex

Texas is suing all of the big TV makers for spying on what you watch

How China built its ‘Manhattan Project’ to rival the West in AI chips

Skills for organizations, partners, the ecosystem

Classical statues were not painted horribly

Two kinds of vibe coding

T5Gemma 2: The next generation of encoder-decoder models

Delty (YC X25) Is Hiring an ML Engineer

The Legacy of Nicaea

How did IRC ping timeouts end up in a lawsuit?

Show HN: Picknplace.js, an alternative to drag-and-drop

The Scottish Highlands, the Appalachians, Atlas are the same mountain range

FunctionGemma 270M Model

1.5 TB of VRAM on Mac Studio – RDMA over Thunderbolt 5

Firefox will have an option to disable all AI features

TRELLIS.2: state-of-the-art large 3D generative model (4B)

Show HN: Stop AI scrapers from hammering your self-hosted blog (using porn)

Your job is to deliver code you have proven to work

Meta Segment Anything Model Audio

Oliver Sacks put himself into his case studies – what was the cost?

How to hack Discord, Vercel and more with one easy trick

I've been writing ring buffers wrong all these years (2016)

Using TypeScript to obtain one of the rarest license plates

AI Vending Machine Was Tricked into Giving Away Everything

Please just try HTMX

The <time> element should do something

Launch HN: Pulse (YC S24) – Production-grade unstructured document extraction

The immortality of Microsoft Word

How to hack Discord, Vercel and more with one easy trick

Comments

Beginning January 2026, all ACM publications will be made open access

We pwned X, Vercel, Cursor, and Discord through a supply-chain attack

GPT-5.2-Codex

Texas is suing all of the big TV makers for spying on what you watch

How China built its ‘Manhattan Project’ to rival the West in AI chips

Skills for organizations, partners, the ecosystem

Classical statues were not painted horribly

Two kinds of vibe coding

T5Gemma 2: The next generation of encoder-decoder models

Delty (YC X25) Is Hiring an ML Engineer

The Legacy of Nicaea

How did IRC ping timeouts end up in a lawsuit?

Show HN: Picknplace.js, an alternative to drag-and-drop

The Scottish Highlands, the Appalachians, Atlas are the same mountain range

FunctionGemma 270M Model

1.5 TB of VRAM on Mac Studio – RDMA over Thunderbolt 5

Firefox will have an option to disable all AI features

TRELLIS.2: state-of-the-art large 3D generative model (4B)

Show HN: Stop AI scrapers from hammering your self-hosted blog (using porn)

Your job is to deliver code you have proven to work

Meta Segment Anything Model Audio

Oliver Sacks put himself into his case studies – what was the cost?

How to hack Discord, Vercel and more with one easy trick

I've been writing ring buffers wrong all these years (2016)

Using TypeScript to obtain one of the rarest license plates

AI Vending Machine Was Tricked into Giving Away Everything

Please just try HTMX

The <time> element should do something

Launch HN: Pulse (YC S24) – Production-grade unstructured document extraction

The immortality of Microsoft Word