unknown

btw their supabase storage bucket is publicly accessible via any signed url token 😭

exposes:

> employee background checks
> equity vesting schedules and grant amounts
> performance reviews
> session tokens for stripe, notion, etc
> screenshots below 🧵

i also got access to their notion 😛

<p>btw their supabase storage bucket is publicly accessible via any signed url token 😭

exposes:

&gt; employee background checks
&gt; equity vesting schedules and grant amounts
&gt; performance reviews
&gt; session tokens for stripe, notion, etc
&gt; screenshots below 🧵

i also got access to their notion 😛</p>

Gergely Orosz

Delve, a compliance startup that issues SOC and other certifications under a 'vibe compliance' model, was found to have left its own sensitive documents unsecured, exposing a fundamental contradiction between the certifications it sells and its own security practices. The incident serves as a cautionary tale about compliance theater and startups that rubber-stamp certifications without genuine security rigor.

Chefs kiss.

Delve issues “vibe complaince” rubberstamp SOC and other certifications, while leaving their own door wide open w sensitive documents unsecured… for who knows how long. Security 101

A cautionary tale of a complaince startup faking everything, and almost making it

<p>Chefs kiss.

Delve issues “vibe complaince” rubberstamp SOC and other certifications, while leaving their own door wide open w sensitive documents unsecured… for who knows how long. Security 101

A cautionary tale of a complaince startup faking everything, and almost making it</p>