DEV Community: wxwreak

How I Discovered a Leak Exposing 1,000+ Customer Emails via a Simple API Query (?select=*)

wxwreak — Sat, 07 Nov 2026 11:37:36 +0000

While inspecting the web traffic of hiddenweb, I stumbled upon a major database security flaw. By changing a single query parameter, I was able to access a leaked database containing over 1,000 cleartext customer emails and private multi-tenant store data.

Responsible Disclosure Timeline

October 30, 2026: Vulnerability discovered during a routine traffic audit.
October 30, 2026: Detailed bug report sent to the development team.
October 30, 2026: Developers acknowledged the issue and deployed a security patch.
October 30, 2026: Re-tested the endpoint to confirm the vulnerability was fully resolved.

1. The Vulnerability & Discovery

While auditing how data flows through the app, I opened Burp Suite to inspect the background API requests.
Looking through the HTTP History tab, I noticed the app was making direct calls to the Supabase database REST endpoint using the public anonymous key. The main security flaw was that the database rules trusted the frontend completely, lacking proper column-level restrictions for the anon user role.

Exploring the `reviews` Table (1,000 Customer Emails Leaked)

While the frontend UI was designed to only show public review contents (like names and comments), the underlying database endpoint accepted the wildcard query selector (select=*) without validation.

I sent the intercepted request from HTTP History over to the Burp Suite Repeater and modified the query parameter to:

GET /rest/v1/reviews?select=* HTTP/2

The backend bypassed the intended frontend logic and returned raw database rows. Because the multi-tenant database stored reviews from various storefronts in a shared instance, this single wildcard query in Repeater exposed database rows linked to internal store_id values—exposing over 1,000 cleartext customer email addresses in total across different shops.

In PostgREST/Supabase APIs, filtering for an exact match is done using the eq operator (which means equal). I extracted a store_id from the initial leaky response and appended it to my request:

GET /rest/v1/reviews?select=*&store_id=eq.xxxxxxxxxxxxxxxxxxxx HTTP/2

The API accepted this logic perfectly. It filtered down the results, proving that anyone could target a specific merchant on the platform and mass-harvest exclusively their customer emails (which could lead to highly targeted phishing or spam via fake links sent to their emails).

Here is the exact request and response captured inside Burp Suite:

(Note: Real user emails and internal IDs have been partially blurred for privacy).

The Patch: Verifying the Fix

To ensure no rules were broken and that vulnerability is no longer exploitable, I re-tested the exact same wildcard endpoint after the developer deployed the security patch.
When sending the GET /rest/v1/reviews?select=* request now, the Supabase backend actively restricts the output. Instead of leaking internal database rows and customer emails, it blocks the query completely and returns a 42501 database error code stating: "permission denied for table reviews".

This confirms that Row Level Security (RLS) and table permissions are now properly configured and protecting the platform's data.
Here is the Burp Suite Repeater screenshot proving that the leak has been successfully patched:

2. Bonus Discovery: Missing Security Headers

While analyzing the infrastructure of hiddenweb, I also checked the HTTP response headers of the production server. A properly configured web server should utilize standard security headers to defend the application and its users against client-side attacks.

Unfortunately, as shown in the scan below, the server was missing almost every critical security header:

Content-Security-Policy (CSP): Missing entirely. This is crucial for mitigating Cross-Site Scripting (XSS) and data injection attacks by restricting where resources can be loaded from.
X-Frame-Options: Missing, meaning the website could be embedded into an external <iframe>, making it vulnerable to Clickjacking attacks.
Strict-Transport-Security (HSTS): Not enforced. This leaves users vulnerable to SSL stripping and Man-in-the-Middle (MitM) attacks by not forcing browsers to interact only over secure HTTPS connections.
X-Content-Type-Options: Not set to nosniff, which exposes users to MIME-sniffing vulnerabilities where browsers try to guess and execute malicious file types.
Referrer-Policy: Not configured. This header is important to control how much referral information (like URLs or data in the Referer header) is leaked when users navigate to external links.
Permissions-Policy: Missing entirely. This header allows a site to restrict access to sensitive browser features and hardware functions (like camera, microphone, or geolocation) to prevent abuse.

Building a Secure & Elegant Anonymous Confession Bot in Discord.py (with Cogs & Rich Logging)

wxwreak — Sun, 20 Sep 2026 12:58:34 +0000

🤫 AnonBot

A sleek, modern anonymous confession Discord bot built with python, discord.py, and rich terminal styling.

✨ Features

Modular Architecture: Utilizes discord.ext.commands.Cog via the cogs/ directory.
Strict Channel Restriction: The /send command only works in a designated source channel (SEND_CHANNEL_ID) and forwards submissions safely to a target channel (POST_CHANNEL_ID).
Built-in Rate Limiting: Enforces cooldowns per user (@app_commands.checks.cooldown) to prevent spamming.
Rich Terminal Logging: Startup sequences and diagnostics styled nicely with the rich library.

📂 Project Structure

my_discord_bot/
│
├── cogs/
│   └── anonym.py
├── .env
├── bot.py
└── requirements.txt

⚙️ Configuration (`.env`)

Create a .env file in the root directory and configure your keys:

DISCORD_TOKEN=your_bot_token_here
GUILD_ID=your_development_guild_id_here
SEND_CHANNEL_ID=id_of_channel_where_users_type
POST_CHANNEL_ID=id_of_channel_where_confessions_appear

🚀 Installation & Running

Clone the repository:

   git clone https://github.com/wxwreak/anon-discord-bot
   cd anon-discord-bot

Install dependencies:

   pip install discord.py python-dotenv rich

Run the bot:

   python bot.py

Introducing Vulnfy: A Lightweight, Multi-Ecosystem Vulnerability Scanner for Your CI/CD Pipeline

wxwreak — Sun, 16 Aug 2026 17:15:12 +0000

Hey DEV community!👋
As developers, we all know how crucial dependency and container security is. But let's be honest - sometimes heavy enterprise security tools are overkill for side projects, smaller apps, or quick sanity checks. I wanted something lightweight, fast and dead-simple to integrate into Github Actions without complex configurations.

That's why I build Vulnfy - an open-source, cross-platform dependency and container vulnerability scanner written in Python. It automatically detects project configuration and lock files across multiple langs, queries the OSV API in bulk, and alerts you instantly.

What Makes Vulnfy Different?

Multi-Ecosystem Support: Scans dependencies for Python, Node.js, Go, PHP, Rust, and container base images.
Batch OSV API Integration: Efficiently checks packages in bulk using the OSV batch query API.
Smart Notifications: Automatically sends alerts to Discord or Telegram only when vulnerabilities match or exceed your configured threshold, completely eliminating spam when your codebase is clean.
CI/CD Ready & Threshold Control: Use --fail-on <level> to customize when the build fails (low, medium, high, critical).
Vulnerability Suppression (.vulnignore): Easily ignore known or unfixable vulnerabilities directly from your project's root directory to prevent CI blockage and alert fatigue.
Automatic Dependency Resolution: Automatically installs missing requirements (requests, colorama, PyYAML) on first run.
Structured Output: Exports all discovered vulnerabilities and associated CVEs into a clean JSON report.

Supported Ecosystems & Files

Ecosystem	Files
Python	requirements.txt, pyproject.toml
NPM	package.json, package-lock.json
Go	go.mod
PHP	composer.lock
Rust	Cargo.lock, Cargo.toml
Docker	Dockerfile, docker-compose.yml

Quick Start & Installation

You can install Vulnfy quickly or pull it directly from Github:

pip install git+https://github.com/wxwreak/vulnfy.git

Or run it locally with a simple command in your project directory:

vulnfy

Github Actions Integration

Adding Vulnfy to your CI/CD workflow takes just a few lines. Create .github/workflows/scan.yaml:

name: Vulnfy Security Scan

on:
  push:
    branches: [ main ]
  workflow_dispatch:

jobs:
  vulnfy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Vulnfy
        run: pip install git+https://github.com/wxwreak/vulnfy.git

      - name: Run Vulnfy Scanner
        env:
          DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
          TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
          TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
        run: vulnfy --fail-on high

Configuration & Alerts

Want to hook it up to Telegram or Discord? Just drop a vulnfy.yaml file into your root directory:

notifications:
  discord:
    enabled: true   # Set to true for Discord alerts
  telegram:
    enabled: false  # Set to true for Telegram alerts

(And store your webhooks/tokens securely in Github Secrets/.env file).

🎉 Tackling Alert Fatigue: Big Updates to Vulnfy Security Scanner!

Huge thanks to the community feedback pointing out that lightweight security tools must avoid alert fatigue. Nobody wants a security scanner that pings them for every single low-severity flaw or spam notification when the codebase is clean.

Based on that feedback, I've just pushed a fresh update to Vulnfy—a lightweight, cross-platform dependency and container vulnerability scanner written in Python.

Here is what is new in this release:

1. Smart Notifications & Severity Thresholds

Notifications to Discord and Telegram are now completely customizable. Vulnfy will only send alerts when vulnerabilities match or exceed your configured threshold (e.g., --fail-on medium or high), completely eliminating spam.

2. Multi-Format Reporting

Beyond the default JSON, Vulnfy now natively supports exporting your scan reports into:

📄 HTML (with custom styling support)
📝 Markdown
📊 CSV
⚙️ YAML
📑 PDF (via HTML templates)

3. Vulnerability Suppression (`.vulnignore`)

Got a false positive or a vulnerability you can't fix right this second? Just add the CVE or ID to a .vulnignore file in your root directory. Ignored items won't trigger CI failures or spam your chat channels.

4. CLI Enhancements (`--no-cache`)

Added the --no-cache argument to keep your workspace clean and prevent Python from generating unnecessary __pycache__ and bytecode files during scans.

Give it a Try!

Vulnfy is completely open-source, and i'm actively working on improving it.

Check out the repo on Github: ⭐️
Let me know what you think in the comments below!