Numbing
New Member
The Bootlegger CEO has publicly posted about discovering Claude, vibecoding his own internal software, and being “almost certain” that software itself will soon become free.
Meanwhile, the company has a publicly accessible internal dashboard serving operational data to unauthenticated visitors.
It was discovered in a pretty mundane way: current Bootlegger employees were posting photos of their laptop screens on Instagram, the site was visible in those posts, and somebody looked it up.
The site appears to have been publicly accessible for months. Google had indexed it by July, and it also appears in the Wayback Machine’s capture history.
No hacking involved, no login bypass, no credentials, no exploit. Just a sloppy AI-generated implementation.
You can open the login page normally, view the page source, and find embedded datasets containing historical sales per store, store performance, new-store opening timelines, forecast turnover, future locations, contact details and other internal operational data.
The login screen is almost beside the point. The browser is being sent the data before authentication.
And this isn’t some abandoned proof of concept that was accidentally left online. The dashboard has continued receiving updates while remaining publicly reachable.
LinkedIn post:
https://www.linkedin.com/feed/update/urn:li:activity:7478176380975894528/
Wayback:
https://web.archive.org/web/20260000000000*/https://bos-dashboard-production.up.railway.app/
Question for the devs out there: how wild is your company’s CEO allowed to go with AI before someone has to step in and say, maybe don’t put internal data on the public internet?
Meanwhile, the company has a publicly accessible internal dashboard serving operational data to unauthenticated visitors.
It was discovered in a pretty mundane way: current Bootlegger employees were posting photos of their laptop screens on Instagram, the site was visible in those posts, and somebody looked it up.
The site appears to have been publicly accessible for months. Google had indexed it by July, and it also appears in the Wayback Machine’s capture history.
No hacking involved, no login bypass, no credentials, no exploit. Just a sloppy AI-generated implementation.
You can open the login page normally, view the page source, and find embedded datasets containing historical sales per store, store performance, new-store opening timelines, forecast turnover, future locations, contact details and other internal operational data.
The login screen is almost beside the point. The browser is being sent the data before authentication.
And this isn’t some abandoned proof of concept that was accidentally left online. The dashboard has continued receiving updates while remaining publicly reachable.
LinkedIn post:
https://www.linkedin.com/feed/update/urn:li:activity:7478176380975894528/
Wayback:
https://web.archive.org/web/20260000000000*/https://bos-dashboard-production.up.railway.app/
Question for the devs out there: how wild is your company’s CEO allowed to go with AI before someone has to step in and say, maybe don’t put internal data on the public internet?
