HackerNews中文版

几周前，我探索了 [已编辑]，一个由 YC 投资的 AI 后端平台。像许多安全研究人员一样，我倾向于试探新工具，看看它们如何处理常见的攻击向量。很快就发现了问题，包括安全性和用户体验方面的问题。 ## 漏洞 *授权漏洞*：[已编辑] 限制免费用户使用 3 个项目，更多项目需要付费。但他们的 API 并没有强制执行此限制。任何人都可以绕过前端并直接调用 API。这个经典的漏洞意味着免费用户可以生成无限内容，付费层级失去价值，商业模式崩溃。 *用户体验问题*：该平台还存在令人困惑的导航、不一致的设计、糟糕的层级结构、笨拙的工作流程和不清晰的入门引导。当产品体验感觉如此粗糙时，安全漏洞只是被忽视的另一个迹象。 ## 响应我在他们的社区频道中询问了他们的披露流程。创始人回复说： “嗨 [姓名]，我看到了你在普通频道上的消息。目前，我们不招聘，但人们正在帮助改进平台，这对我们未来招聘人员来说是一个很好的测试。如果你想做出贡献，请随时向我们报告错误或安全问题。如果与安全相关，最好在私信中进行，而不是在普通频道中进行。” 翻译：请为我们做免费的安全工作。也许我们有一天会雇用你。 ## 为什么我没有披露我没有透露细节，因为： - 没有漏洞赏金或认可系统 - 安全研究被定义为“免费测试” - 对未来考虑的模糊承诺，而不是当前的报酬 - 没有披露政策或时间表 - 整体缺乏专业性发现和负责任地报告漏洞需要技能。期望研究人员免费这样做，尤其是对于一家获得融资的初创公司来说，是不可接受的。 ## 更广泛的问题这反映了一个更大的初创公司问题：希望社区提供帮助，但不为此付费。公司经常要求无偿的质量保证、安全审计、错误报告和用户体验反馈，同时筹集数百万资金。 ## 优秀的公司会做什么最好的公司有： - 明确的披露政策，并定义了时间表 - 漏洞赏金计划（即使是小的也能表示尊重） - 与研究人员进行专业沟通 - 对负责任的披露进行公开认可这不需要太多。即使是 10 美元的礼品卡和感谢信也很重要。 ## 当前状态一个月后，该漏洞仍未修复，用户体验仍然很差。对于用户来说，这意味着不准确的使用情况跟踪、经济模式崩溃、可能更深层的问题以及持续的挫败感。对于公司来说，它揭示了一种文化，在这种文化中，安全、用户体验和尊重都是事后考虑的。 ## 给创始人的经验教训 *安全基础知识*： - 在服务器端强制执行所有限制。永远不要相信前端。 - 发布一个简单的披露政策。 - 尊重研究人员，我们正在努力提供帮助。 *文化基础知识*： - 不要要求免费劳动。 - 将反馈视为有价值的，而不是免费的质量保证。 - 记住第一印象很重要。安全社区希望提供帮助，但前提是不以低估专业知识为代价。构建安全的产品。创造直观的体验。尊重那些帮助你改进的人。安全债务会迅速累积，但用户体验债务会更快地扼杀用户采用。 --- 你是否也有过类似的经历，AI 初创公司期望免费的安全工作？你如何处理那些忽视安全的公司？

查看原文

A few weeks ago, I explored [redacted], a YC-backed AI backend platform. Like many security researchers, I tend to poke at new tools to see how they handle common attack vectors.It didn’t take long to find issues, both in security and user experience.## The Vulnerabilities*Authorization Flaw*: [redacted] limits free users to 3 items, with a paywall for more. But their API doesn’t enforce this. Anyone can bypass the frontend and call the API directly.This classic flaw means free users can generate unlimited content, paid tiers lose value, and the business model collapses.*UX Problems*: The platform also has confusing navigation, inconsistent design, poor hierarchy, clunky workflows, and unclear onboarding. When the product experience feels this raw, security flaws are just another sign of neglect.## The ResponseI asked in their community channel about their disclosure process. The founder replied:“hi [name], i just saw your message on the general channel. right now, we are not hiring, but people are helping improving the platform and this is a good test for the future, when we will hire people. if you want to contribute, feel free to report bugs or security issues to us. if security related, it's best on private dms rather than on general channel”Translation: Please do free security work for us. Maybe we’ll hire you someday.## Why I Didn’t DiscloseI withheld details because: - No bug bounty or acknowledgment system - Security research framed as "free testing" - Vague promise of future consideration, not present compensation - No disclosure policy or timeline - Overall lack of professionalismFinding and responsibly reporting vulnerabilities takes skill. Expecting researchers to do it for free, especially from a funded startup, is unacceptable.## The Broader ProblemThis reflects a larger startup issue: wanting community help without paying for it. Companies routinely ask for unpaid QA, security audits, bug reports, and UX feedback while raising millions.## What Good Companies DoThe best companies have: - Clear disclosure policies with defined timelines - Bug bounty programs (even small ones show respect) - Professional communication with researchers - Public acknowledgment for responsible disclosureIt doesn’t take much. Even a $10 gift card and a thank-you matter.## Current StatusA month later, the vulnerability is still unfixed, and UX remains rough.For users, this means inaccurate usage tracking, broken economics, possible deeper issues, and ongoing frustration. For the company, it reveals a culture where security, UX, and respect are afterthoughts.## Lessons for Founders*Security basics*: - Enforce all limits server-side. Never trust the frontend. - Publish a simple disclosure policy. - Respect researchers, we’re trying to help.*Cultural basics*: - Don’t ask for free labor. - Treat feedback as valuable, not free QA. - Remember that first impressions last.The security community wants to help, but not at the cost of undervaluing expertise.Build secure products. Create intuitive experiences. Respect those who help you improve. Security debt compounds quickly, but UX debt kills adoption even faster.---Have you had similar experiences with AI startups expecting free security work? How do you handle companies that dismiss security?

初创公司要求免费安全服务时