My first CVE (the bad kind)

Let me set the scene: Friday night, after two weeks of fun security issues. A pile of leftover Claude tokens burning a hole in my pocket. A vague feeling that computing as we know it is fundamentally broken. That’s when she walked into my office. Trouble, in a red dress. She had legs for miles, and an HTTP request that went somewhere it shouldn’t. Uh, sorry, got a bit carried away there. So, anyway, I thought maybe I should try throwing Claude Code at some security audits. I’ve had LLMs do it before, and they weren’t particularly impressive. On chameth.com I have a little admin mode that sets an isadmin=1 cookie. If you have that cookie it shows some edit links, which don’t work unless you’re on my tailnet. I find this deliberate lack of security quite funny, but LLMs do not. And that’s the kind of “security finding” I expected. But models are advancing stupidly fast, so maybe it was worth another go? I ran through a list of projects and picked the juiciest targets: those used by more…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town