This is identical to a comment you wrote on the other story about these vulnerabilities that's higher up on the front page, which isn't great.

You bet not all THW vulnerabilities are reported to the vendors. Not with 5k bounty for THAT.

A similar comment was posted on the PostHog post yesterday. Claiming everything is vibe coded without any proof is pure rage bait.

Chill - just because someone got hacked doesn't mean their product is trash. Easily every mass adopted product created prior to 2023 has been hacked at some point.

> This feels so emblematic of our current era. VC funded vibe coded AI documentation startup somehow ...

Is there any indication Mintify was "vibe coded"?

fun fact: last BigCo I worked in had an elaborate architecture/security bar for new applications/features but offered a clever workaround - you could use a pre-approved solution and skip numerous quality checks and approvals, so every single PO was pushing for that specific solution.

The result? A static html with 500 ppl audience was billing a whooping 2k EUR a month, because that was the cost of that pre-approved architecture.

Best part - I was championing a company wide solution for that problem for over a year, which resulted in board level special operation with 100k budget only to get that budget snugged by people couple steps above the ladder.

Lots of these companies are YC companies, and they tend to use other YC products. For those that aren't, its easier to just use what other big names are using, and having YC as a backing name is quite useful in that regard.

Convenience and developer uncertainty. I fall pray to the "it's paid, so it must be better" fallacy, and the "they know what they are doing, they are pros" illogicality.

It's actually pretty on-par for most bug bounties. They used the same exploit on a few programs and got $11k total which ain't bad return on time.