So did you disclose this responsibly? Posting about it publicly first is asking for that sensitive data to be leaked. Might as well hack and repost that PII yourself.
This is not a data leakage.
They deliberately included 999 of their customers' email addresses in publicly accessible JavaScript code in order to test certain features on them.
Certainly that wasn't intentional to broadcast to the public? Sounds like a textbook data leak.
> A data leak is the unauthorized, often unintentional exposure of sensitive, confidential, or personal information to an external party, usually resulting from weak infrastructure, human error, or system errors.
Totally agree
Check the Wikipedia page "Signs of AI writing", found 2 of them in this post (overuse of em dash and negative parallelism)
Also quickly checked Medvi, their JavaScript looks good...
So did you disclose this responsibly? Posting about it publicly first is asking for that sensitive data to be leaked. Might as well hack and repost that PII yourself.
This is not a data leakage. They deliberately included 999 of their customers' email addresses in publicly accessible JavaScript code in order to test certain features on them.
Certainly that wasn't intentional to broadcast to the public? Sounds like a textbook data leak.
> A data leak is the unauthorized, often unintentional exposure of sensitive, confidential, or personal information to an external party, usually resulting from weak infrastructure, human error, or system errors.
Are the patient emails real patients or could they be test accounts?
The emails are definitely real, I checked a few and they appear in HIBP.
They look like real people's email addresses. I checked a few. They belong to real people.
How do you find such data leaks? Do you manually check all websites you visit?
I was curious to know which service provider they use. So I went to look at the source code of their websites.
Looks like you used a LLM to write your post, or am I wrong?
Totally agree Check the Wikipedia page "Signs of AI writing", found 2 of them in this post (overuse of em dash and negative parallelism) Also quickly checked Medvi, their JavaScript looks good...
Would you like me to show you specific JavaScript files right here?
Yes please, I only checked the ones from homepage, I probably missed some if the other pages includes other scripts
Just open app.medvi.org and search in DevTools gmail/yahoo/icloud and you will see js bundle with emails.
or seasonhealth/openloophealth to find another js bundle with staff emails.
Mamma Mia I see them! Crazy 1018 customer mails addresses at first sight
Yes, and it's a company that makes hundreds of millions of dollars a year.
Yes, LLM assisted.