告诉 HN：Medvi（远程医疗）在公开的 JavaScript 中硬编码了 999 个患者电子邮件地址
2 分•作者: g48ywsJk6w48•3 个月前
Medvi 是一家远程医疗药房，最近受到了媒体的广泛关注。我在使用开发者工具浏览他们的网站时，发现他们公开的 JavaScript 捆绑包中硬编码了一个包含 999 个患者电子邮件地址的列表——以及每位患者的注册日期、活动状态，以及是否分配了护理经理。所有访客的浏览器都会在登录前下载这些数据。
这个列表并非遗留产物，而是被积极使用：应用程序会导入它，筛选出活跃患者，并检查登录用户的电子邮件是否出现在列表中，以决定显示哪些 UI 功能。这是一种将真实患者数据嵌入捆绑包中的客户端功能标志。
同一个捆绑包还暴露了一个 Season Health（Medvi 的母公司）员工电子邮件列表，用于绕过结账流程，以及一个单独的 Open Loop Health（他们的临床服务提供商）员工电子邮件列表，用于绕过入院表格逻辑——这两个列表在源代码中都有明确的标签。
这再次证明，仅仅依靠大型语言模型进行产品开发还为时过早。
查看原文
Medvi is a telehealth pharmacy that has received significant media attention recently. While browsing their site with DevTools open, I noticed that their public JavaScript bundle contains a hardcoded list of 999 patient email addresses — along with each patient's enrollment date, active status, and whether a care manager has been assigned. This data is downloaded by every visitor's browser before any login occurs.<p>The list isn't a forgotten fixture. It's actively used: the app imports it, filters for active patients, and checks whether the logged-in user's email appears in the list to decide which UI features to display. Client-side feature flagging with real patient data baked into the bundle.<p>The same bundle also exposes a list of Season Health (Medvi's parent company) employee emails used to bypass checkout flows, and a separate list of Open Loop Health (their clinical provider) staff emails used to bypass intake form logic — both labeled as such in the source.<p>This is another great demonstration that relying only on large language models for product development is premature.