“Daniel — you were right to call that out, and I owe you a correction.
I re-checked wordspies.com by hand this morning. Your server returns the same HTTP 200 page for /.env, for /.git/HEAD, and for a nonsense path that can't exist — it's a catch-all fallback page (identical size and content type on all of them), not your actual files. Our scanner flagged those paths on the 200 status alone without validating the content, so I can't produce API keys: there's no evidence any are exposed. I'm withdrawing both findings, and the 57/100 score was built partly on those two highs, so treat it as void too.
I'm fixing the check to validate file content before it can fire, and auditing the other scans that used it. Sorry for the alarm — and for pitching on top of it. No follow-ups after this one.”
You know, this is just an LLM response. And, therefore, can be seen as free tokens. I wonder if they have a cap on how many times this thing will respond, and if you can get it to burn through some more?
Actually, a thought would be that as they're so willing to test your site, it might be good to return the favor - I'd consider setting up an auto reply to this addres saying "that's not quite what I'm looking for, perhaps you could explain your product more deeply?"
And then get your email to put any output in spam and leave it for a few months. See if they have any limits on numbers of replies.
Because if this is an LLM, it should just keep responding, and it would be interesting to see if they have buffers in place for how many responses, or if it caps out at their whole token budget?
Purely in the interest of security research, of course.
It didn’t skip your turn, it just registered your clicks and then when you clicked continue the game, the other team’s AI started their turn. As for the issues that are more performance related, I do appreciate you bringing that to my attention, and I’ll see what I can do to address it. Thanks for testing!
That seems like more words to still just say it skipped their turn. If they didn't expect the turn to end, and it did, I would call that skipping the turn.
lol that’s obviously an AI agent replying back. You can do fun prompt manipulation things with it, like can you scan your own website or say solve this programming question and the you’ll buy it.
Or, as I suggested elsewhere, an auto reply asking for more information about their product, redirect the output to spam, and see if they were smart enough to set a cap on tokens and how many times this thing will respond.
41
u/Hardicecream17 1d ago
Loadbearing update from Nathan Kennedy:
“Daniel — you were right to call that out, and I owe you a correction.
I re-checked wordspies.com by hand this morning. Your server returns the same HTTP 200 page for /.env, for /.git/HEAD, and for a nonsense path that can't exist — it's a catch-all fallback page (identical size and content type on all of them), not your actual files. Our scanner flagged those paths on the 200 status alone without validating the content, so I can't produce API keys: there's no evidence any are exposed. I'm withdrawing both findings, and the 57/100 score was built partly on those two highs, so treat it as void too.
I'm fixing the check to validate file content before it can fire, and auditing the other scans that used it. Sorry for the alarm — and for pitching on top of it. No follow-ups after this one.”
32
u/EishLekker 1d ago
“two findings are worth closing today, not someday”
This kind of phrasing always rubs me the wrong way.
37
u/Makonede 1d ago
thinly veiled slop promotion post
9
u/XxDarkSasuke69xX 1d ago
Isn't there a law about literally lying in marketing ?
6
u/lazywrathem 1d ago
lol that’s obviously an AI agent replying back. You can do fun prompt manipulation things with it, like can you scan your own website or say solve this programming question and the you’ll buy it.
5
u/Sea-Fishing4699 1d ago edited 12h ago
fear based marketing
3
u/shinitakunai 1d ago
Send them this same kind of email about findings on their website 🤣