u/LordEli

Someone posted a chat app here recently and thought I would poke around a little. Within 30 minutes I was able to completely break the app.

I am redacting the domain and sensitive data.

The app works. The UI is fine. There are more features than you would expect from a weekend project, from the outside it looks like a finished app but when you look under the hood not so much...

Just about everything that could be wrong was wrong.

• Exposed OpenAI private key in public javascript bundle
• Firebase config fully public
• localStorage used for identity management
• Admin and report data readable without access controls
• Ban system not verified by backend

Firebase was the biggest issue. The database rules were wide open. Anyone could read and modify all chat rooms (There are private rooms that should require a password), reported users, admin logs, user stats, ban lists, etc.

I was able to adjust my user rank but also can modify the data of any other user in the app. (Falsify messages, derank, change username, etc)

The ban system is entirely ineffective, it uses a localStorage device ID, someone could just change the value themselves or clear cache and cookies and evade a ban.

Common problems:

• Exposed API keys in frontend
• Firebase/Supabase with improper permissions
• Trusting browser and device state
• Trusting localStorage for identity
• Client side admin checks
• Client side moderation checks
• User roles, ranks, credits, or balances stored in writable records
• Private data hidden in the UI but readable through the backend

If you are building these apps, please check this before you ship:

• Search your deployed JavaScript for sk_, sk-, OPENAI, SECRET, TOKEN, and PRIVATE. There should be no private keys exposed in the frontend.
• Test your Firebase or Supabase permissions while logged out.
• Try reading your database directly from a terminal.
• Make sure admin-only paths are protected by backend rules, not just hidden buttons.
• Do not trust localStorage as proof of identity.
• Do not let users directly write their own role, rank, balance, message count, or subscription status.

AI tools can help you build fast. That part is real. But if the app touches users, money, moderation, private rooms, admin panels, or anything people care about, it needs a security pass before it goes live.

From the blog post:
AI agents run reconnaissance, test exploits, and weaponize vulnerabilities at machine speed – collapsing the mean time from CVE disclosure to confirmed exploitation from 2.3 years in 2018 to roughly 10 hours in 2026, with 72.7% of exploited CVEs in 2026 hitting as zero days, up from 16.1% in 2018.  

A guide from Anonymous' OnionIRC server in spring 2016 distilled from a number of live sessions. Covers Tor usage, VPNs, and behavioral fingerprints that lead to identifying operators. Includes the original log files

I have read the rules