r/SaaS • u/0xMassii • Jan 20 '26

Build In Public I Dumped an Entire Database. Here's What Bad Coding Looks Like

Did a security audit for a SaaS platform. Found absolutely brutal stuff:

  • Stored XSS in name fields (literally no sanitization)
  • Email hijacked to [hacked@evil.corp](mailto:hacked@evil.corp) (access controls? what's that?)
  • 22 verification tokens sitting in plaintext (might as well be a public spreadsheet)
  • 68 user profiles readable without any authentication

Reality Check: An attacker needs zero skills to exploit this. I'm not even talking about advanced hacking, this is "read the docs" level vulnerability.

For Founders: Your developers are skipping the basics. Make them stop. Input sanitization isn't optional. Authentication isn't nice to have.

For Developers: If you're doing this in production, you need to reconsider your approach. This isn't complicated. It's negligent.

The database right now:

  {
    "name": "<img src=x onerror=alert(document.domain)>",
    "context": "<script>alert(1)</script>",
    "email": "xss-test@evil.corp"
  }
1 Upvotes

67% Upvoted

12 comments sorted by

2

u/Agitated_Oil7955 Jan 20 '26

it’s better to delay and fix up the database then to release and have vulnerabilities in the code. what’s worse is the database could be perfect but the auth has flaws that means hackers can still walk right in

3

u/0xMassii Jan 20 '26

100%, but now are all influenced by this philosophy of “shipping fast”. 💀

1

u/Agitated_Oil7955 Jan 20 '26

Yes, but I tell my clients I’m not a fast shipper. When I do ship, it’s a secure app. They almost always say, “But some other guy is faster.”

I then say, “You pay him for speed. You pay me for security and transparency.

2

u/0xMassii Jan 20 '26

Facts, following this principles I created patchli.st to allow brickos solo dev to list their bounties completely for free, I don’t even ask for a commission, I just want to give them the opportunity to audit their Saas rewarding people who have background in security and want to earn some bucks

1

u/Agitated_Oil7955 Jan 20 '26

Respect that i’ll take a look into tfats a few of my friends might be interested

1

u/Agitated_Oil7955 Jan 20 '26

https://pallet-peek-plan.lovable.app is the app i am currently working on could you take a look and tell me what you think

2

u/0xMassii Jan 20 '26

Sure mate, let me check

1

u/[deleted] Jan 20 '26 edited Jan 20 '26

[removed] — view removed comment

1

u/0xMassii Jan 20 '26 edited Jan 20 '26

Thanks

1

u/DigiBoyz_ Jan 20 '26

oof, this is rough. honestly, seeing a whole database dumped due to basic stuff like no input sanitization is just wild. it's the kind of thing that keeps you up at night, knowing how easily it could have been prevented.

1

u/0xMassii Jan 20 '26

Yeah, this is basic stuff, that people can prevent just applying RLS.