This doesn't change the fact that you'd still be able to exfiltrate data like sure they don't get credentials but if they get the proxy auth key then they would also be able to make requests through it no?
Would also like to give a shoutout to Stytch. We've used them since day 0 to build our entire auth system, and have found the overall dev experience to be quite great
The vulnerability issue that you reported, if I recall correctly, was relating to server-forwarding attacks via our API playground. We've addressed that issue around 8 months ago, and unfortunately, it was not the root of this incident.
This is Han, I'm one of the co-founders from Mintlify.
For the security of our customers from the publicity we were expecting from the announcement, we've decided to leave out the technical details of the breach in the blog post.
The source of this security incident was due to an uncaught error response in one of our APIs that didn't properly format the response before sending it back to the client. The response contained our internal admin tokens, which can then be used to access internal endpoints, which unveiled sensitive user information.
Our initial patch upon discovering the incident fixed the response of the vulnerable endpoint, but we have since also implemented a sweeping number of security provisions and are also in the process of completely deprecating the admin tokens and GitHub OAuth entirely to prevent an incident like this from ever happening again.
Totally agreed. While the frontend and core functions are open source, the backend under the `server` folder is source available. We made the mistake of referring to the entire repo as open source, which we will refrain from in the future.
We totally agree! We think it would be best when documentation is centralized, version controlled, and coupled with the code. Unfortunately, we realized that's just not the case for the vast majority of companies. One way to think about our product is just bringing the features of documentation on GitHub into existing documentation that lives outside of it.
That is correct. The backend covers enterprise features that are only source-available, whereas the rest of the application is open source. We understand that this can be quite misleading, and will refrain from saying that we are open source in the future
Thank you for sharing the article! We definitely don't see companies having all docs in their repos, but strongly believe that there should be stronger ties between docs and code (and more transparency in docs in general)
It's a really hard problem to solve, but we believe that there will be a product that will crack it (even if it's not what we have right now)
Thank you so much for the incredible feedback! We think you are absolutely SPOT ON. We would really love to chat more with you 1:1. Please reach out to us at [email protected]