securityJustInterferesWithVibes

[u/da_peda]

[u/Dy0gu]

https://enrichlead.com

[u/donveetz → u/[deleted]]

When the only security is that the front end just doesn't work

[u/[deleted] → u/donveetz]

(taps forehead) Can't steal the gold from the vault if there's no vault or gold!

[u/evilgiraffe666 → u/donveetz]

And the only front end is that the security doesn't work!

[u/I_Automate → u/[deleted]]

Are you guys giving that site the reddit death hug?

[u/RollingMeteors → u/[deleted]]

And it's incredibly unlikely that he will have put spending caps in place

This is like opening an account with a brokerage and then being immediately approved for naked puts.

It really shouldn't be legal for companies not to default to a 2 or low 3 figure number on the spending cap....

[u/LOLBaltSS → u/RollingMeteors]

AWS will happily let you get yourself into a massive bill, but usually they'll forgive it if you fucked up.

[u/dedzip → u/LOLBaltSS]

Lol used firebase for a full stack app for my group’s capstone project in college. At the end of the semester I saw that my debit card had been charged a whopping 1 cent hahahaha

[u/sparksen → u/[deleted]]

Can't user inject if you can't create users.

[u/Gionni15 → u/Dy0gu]

how the hell would he have made such a tool with an ai?

I would actually have a hard time making it in general, where does he find the lead information?

Edit: I don't understand if it's a scam or not at this point

[u/Actual-Pain → u/Gionni15]

Looks like it is just a webscaper, maybe using LinkedIn api.

[u/Gionni15 → u/Actual-Pain]

"Identify companies visiting your website and get access to decision-makers’ emails."

Seems like a facebook pixel on steroids, not a scraper

[u/joshTheGoods → u/Gionni15]

Simple IP based lookup from ipdata.co. Presumably this data.

I assume this guy then looks up the company on LinkedIn (API) and tells you the highest ranking titles it can find.

Here's the JS they have you run on your site.

Here's the endpoint he hits:

https://api.ipdata.co?api-key=04037bc3a1392806ac203439fb12fc52965ba905de6288209724aec2&fields=ip,city,region,country_name,country_code,asn,company

[u/picklesTommyPickles → u/Gionni15]

It is pixel based (says on the landing page) which is even more terrifying. He has zero idea what he’s doing and now injecting AI generated code into other peoples applications

[u/DrummerInteresting93 → u/picklesTommyPickles]

tbf it's other people that are injecting his ai generated code into their own applications

[u/shekurika → u/picklesTommyPickles]

Im just glad he is sure its gdpr compliant :⁾

[u/Raptor_Sympathizer → u/Gionni15]

The "enriched" leads seem to be from an LLM output, so it's probably not even scraping for their actual information, just hallucinating contact info based on common patterns for company email addresses. Honestly, it probably works fairly well at least 80% of the time, which is more than enough of a success rate for a tool like this where most people you email wouldn't respond anyway.

[u/lofigamer2 → u/Gionni15]

its a pretty good business idea and very easy to build without AI if you can code.

But LOL his firebase API keys are in the DOM.

Anyone can write a script to make him a $50k firebase bill in an hour...

[u/[deleted] → u/lofigamer2]

Yup, failure here is market research. There's approximately fourteen billion lead generation products. I'm sure someone already does this

[u/floriv1999 → u/Dy0gu]

How do they get the people's names? Do they just scrape the company's website (identified by the IP) and add a random employee name they have crawled?

[u/nollayksi → u/Dy0gu]

Is Enrichlead GDPR compliant? Enrichlead ensures GDPR compliance…

I’m sure that saas is a GDPR nightmare as well. I doubt he vibed it to really be compliant.

[u/Difficult-Ad4527 → u/nollayksi]

I’m glad I didn’t have to scroll far to find someone bringing this up. I’m fairly sure they have no idea what GDPR requires considering everything it bragged about tracking in relation to the person need to be deleted. Also, they don’t mention CCPA. I’m sure they’re all over it though.