Top all-time · #7542
xyzeva's blog
Personal blog · kibty.town/blogsecurity
xyzeva's blog is a personal blog at kibty.town about security. Since 2024, 10 different Hacker News readers have linked it 12 times, most often “How to hack Discord, Vercel and more with one easy trick”. It is still writing: the last post was on 2026-11-01, and you can follow it by feed.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
Eva's security research posts on web vulnerabilities, including a poorly configured Firebase database, an Arc browser exploit, and an RCE on a Mintlify server. Commenters mostly link them as supporting evidence.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- How to hack Discord, Vercel and more with one easy trick5 people · 5 mentions · first linked 2025-12-18
- Gaining access to anyones Arc browser without them even visiting a website3 people · 3 mentions · first linked 2024-09-19
- Researcher finds flaw in a16z website that exposed some company data2 people · 2 mentions · first linked 2024-07-19
What Hacker News says?
I think that's throwing the baby out with the bathwater; sane defaults are still an important thing to think about when developing a product. And for something as important as a database, which usually requires authentication or storing personal information, let your tutorials focus on these pain points instead of the promise of a database-driven app with only clientside code. It's awesome, but I think it deserves t…
Comment linking /blog/arc/
on “How to gain code execution on hundreds of millions of people and popular apps”Submitted Gaining access to anyones Arc browser without them even visiting a website as a story · 1469 points
HN discussionThis is the second big attack found by this individual in what... 6 months? The previous exploit (which was in Arc browser), also leveraged a poorly configured firebase db: https://kibty.town/blog/arc/ So this is to say, at what point should we start pointing the finger at Google for allowing developers to shoot themselves in the foot so easily? Granted, I don't have much experience with firebase, but to me this jus…
Comment linking /blog/arc/
on “How to gain code execution on hundreds of millions of people and popular apps”Submitted How to gain code execution on hundreds of millions of people and popular apps as a story · 1156 points
HN discussionThis specific XSS vulnerability may not have been, but the linked RCE vulnerability found by their friend https://kibty.town/blog/mintlify/ certainly would've been worth more than the $5,000 they were awarded. A vulnerability like that (or even a slightly worse XSS that allowed serving js instead of only svg) could've let them register service workers to all visiting users giving future XSS ability at any time, even…
Comment linking /blog/mintlify/
on “We pwned X, Vercel, Cursor, and Discord through a supply-chain attack”Submitted Researcher finds flaw in a16z website that exposed some company data as a story · 552 points
HN discussion> Apparently one of the other linked posts shows how you can also gain RCE Yep, here it is: https://kibty.town/blog/mintlify/ Also linked in his guide (which I missed) and [here in a separate HN post]( https://news.ycombinator.com/item?id=46317546 ). I think this other author's post is a lot more detailed and arguably more useful to folks reading on HN.
Comment linking /blog/mintlify/
on “We pwned X, Vercel, Cursor, and Discord through a supply-chain attack”Submitted How to hack Discord, Vercel and more with one easy trick as a story · 175 points
HN discussionTheir collaborator's report includes a more significant issue, an RCE on a mintlify server: https://kibty.town/blog/mintlify/
Comment linking /blog/mintlify/
on “We pwned X, Vercel, Cursor, and Discord through a supply-chain attack”Submitted How to pwn a billion dollar VC firm using inspect element as a story · 11 points
HN discussion> It's not like they weren't thinking about security https://kibty.town/blog/mintlify/ The first CVE here definitely sounds like they absolutely weren't thinking care security.
Comment linking /blog/mintlify/
on “How to hack Discord, Vercel and more with one easy trick”Submitted Why client-side environment variables are a bad idea as a story · 3 points
HN discussion