Tagged with

2 articles found

tl;dv’s Firestore Nightmare: 181,874 Meetings, Zero Tenant Isolation, and the CTO Who Ghosted

How a missing Firestore security rule exposed 181k meetings across 84k users, and what it teaches us about default security in SaaS design.

#data-breach#firestore#saas

data-breach

Metabase Just Got a Perfect 10/10, And Not in a Good Way

A CVSS 10.0 SQL injection zero-day hit Metabase’s password reset endpoint, giving attackers admin access without authentication. Framework, Tally, and LexisNexis are confirmed victims. Here’s what to do.

#data-breach#metabase#sql-injection...