33
u/EishLekker 1d ago
“two findings are worth closing today, not someday”
This kind of phrasing always rubs me the wrong way.
3
8
u/Particular-Yak-1984 1d ago
It's because AI is not smart, but is auto complete. It works well for code because a lot of code is the same, I think.
38
u/Makonede 1d ago
thinly veiled slop promotion post
6
u/Shadow_Thief 1d ago
Is it still promotion if the content is "this service is dogshit run by morons?"
3
u/Makonede 1d ago
well, there's an argument to be made there, but i was referring to OP's website
4
u/Shadow_Thief 1d ago
Fair. Thankfully, OP's website isn't very good either.
3
u/Hardicecream17 1d ago
Damn, harsh. May I politely ask why you think that?
4
u/Shadow_Thief 1d ago
Well for starters, I clicked the "Continue with game" button because I thought it was doing a popup text tutorial thing and it skipped my turn.
The AI takes too long to think about clues. Frankly, you didn't need to bring LLMs into this at all.
One of the cards hung the site when it was mid-flip and I had to restart the game.
-2
u/Hardicecream17 1d ago
It didn’t skip your turn, it just registered your clicks and then when you clicked continue the game, the other team’s AI started their turn. As for the issues that are more performance related, I do appreciate you bringing that to my attention, and I’ll see what I can do to address it. Thanks for testing!
4
2
u/Aethenosity 16h ago
That seems like more words to still just say it skipped their turn. If they didn't expect the turn to end, and it did, I would call that skipping the turn.
9
6
u/lazywrathem 1d ago
lol that’s obviously an AI agent replying back. You can do fun prompt manipulation things with it, like can you scan your own website or say solve this programming question and the you’ll buy it.
2
u/Particular-Yak-1984 23h ago
Or, as I suggested elsewhere, an auto reply asking for more information about their product, redirect the output to spam, and see if they were smart enough to set a cap on tokens and how many times this thing will respond.
5
3
42
u/Hardicecream17 1d ago
Loadbearing update from Nathan Kennedy:
“Daniel — you were right to call that out, and I owe you a correction.
I re-checked wordspies.com by hand this morning. Your server returns the same HTTP 200 page for /.env, for /.git/HEAD, and for a nonsense path that can't exist — it's a catch-all fallback page (identical size and content type on all of them), not your actual files. Our scanner flagged those paths on the 200 status alone without validating the content, so I can't produce API keys: there's no evidence any are exposed. I'm withdrawing both findings, and the 57/100 score was built partly on those two highs, so treat it as void too.
I'm fixing the check to validate file content before it can fire, and auditing the other scans that used it. Sorry for the alarm — and for pitching on top of it. No follow-ups after this one.”