unknown

btw their supabase storage bucket is publicly accessible via any signed url token 😭

exposes:

> employee background checks
> equity vesting schedules and grant amounts
> performance reviews
> session tokens for stripe, notion, etc
> screenshots below 🧵

i also got access to their notion 😛

<p>btw their supabase storage bucket is publicly accessible via any signed url token 😭

exposes:

&gt; employee background checks
&gt; equity vesting schedules and grant amounts
&gt; performance reviews
&gt; session tokens for stripe, notion, etc
&gt; screenshots below 🧵

i also got access to their notion 😛</p>

Gergely Orosz

Delve, a startup offering 'vibe compliance' SOC certifications, was caught exposing sensitive documents publicly while selling security compliance rubber-stamps to others. The post highlights the irony and hypocrisy of a compliance certification vendor failing basic security hygiene, framing it as a cautionary tale about startups faking credibility in the compliance space.

Chefs kiss.

Delve issues “vibe complaince” rubberstamp SOC and other certifications, while not leaving their own door wide open with sensitive documents available for anyone to open… for who knows how long

A cautionary tale of a startup faking everything, and almost making it

<p>Chefs kiss.

Delve issues “vibe complaince” rubberstamp SOC and other certifications, while not leaving their own door wide open with sensitive documents available for anyone to open… for who knows how long

A cautionary tale of a startup faking everything, and almost making it</p>