Someone got in touch claiming there was a way to use the forum or chat to reach data belonging to a different household. Rather than take that on faith or wave it off, we spent the afternoon actually verifying it against the live code.
What we found
The claim was real. We found and fixed three separate issues in the same session:
- A way a malicious profile name could run in another household's browser session when viewed in certain forum interactions.
- A gap in how uploaded files (documents, photos, receipts, insurance files, etc) were served publicly, which could have let unsafe content be hosted on our own domain.
- A weakness in an external calendar-sync feature that could have been used to reach internal-only systems on our server.
What we're not sharing
On purpose, this post doesn't explain the mechanics of any of the three. Publishing exploit details, even for issues that are already fixed, isn't something we do — it doesn't help you, and it's the kind of thing that only helps someone looking for the next one.
Where things stand
All three were fixed and deployed the same day they were found, each one verified end-to-end afterwards rather than just assumed fixed. We also took the opportunity to update some out-of-date backend dependencies flagged by a routine security audit. We haven't found any evidence any of this was actually exploited against a real household — this came from a proactive check, not an incident.
This isn't the end of it — we're continuing a broader review across the rest of the platform, and we'd rather keep finding these ourselves than have someone else find them first.