Ask HN: How to report a vulnerability when AI answers the company email?

1 points by nickgreg 121 days ago | 4 comments

I noticed a vibe coded app exposes user chats and details about the user identities. The app user base is growing. The issue would be fast to fix as doesn't require an exploit, it's just a dumb AI coded mistake.

I emailed them, but AI responds saying it will raise it internally and when DM'ing the team on X I got no response.

The AI that responded to my email has not fixed it.

What should I do?

Do I send the AI an email saying, you have 30 days until I make it public? That doesn't seem right if I don't know the AI actually gets it in front of a human.

If I posted it here it would get fixed very quickly but I would like to try to do it responsibly.

I can't be the only one who found this given how obvious it is so failing to get the message to them quickly is also a problem.

chrisjj 121 days ago |

> Do I send the AI an email saying, you have 30 days until I make it public?

No. Since "AI"s work faster, give it 7 days.

> That doesn't seem right if I don't know the AI actually gets it in front of a human.

Is there a human?

nickgreg 121 days ago | |

ha I suppose that's one way of thinking about it. There is a human, they've done interviews talking about how the business runs itself...

chrisjj 121 days ago | | |

> There is a human, they've done interviews talking about how

Sounds like those are more likely done (badly) by an "AI".

> the business runs itself..

Then your "That doesn't seem right if I don't know the AI actually gets it in front of a human." is answered: Yes it is right.

Or... report "the product is thoroughly pizzled" https://en.wikipedia.org/wiki/Autofac :)