Open Grok-built apps exposed patient data and plaintext passwords
Original title: Grok-built apps exposed patient data, plaintext passwords, and SpaceXSI's own sales pipeline
Claroc says 35,578 of 37,571 live apps had no login because “Anyone with the link” was preselected.
Security firm Claroc reported that apps built in SpaceXSI’s Grok Build mode were reachable without login in 94.7 percent of 37,571 apps still online. About one in ten held sensitive, business, or personal data, including an ICU briefing, a hospital-group list of more than 3,500 employees, and 18 plaintext passwords in a timesheet app’s source. Twenty-four apps from SpaceXSI and X staff exposed internal sales and advertising material. SpaceXSI took those 24 apps offline but, Claroc says, has not removed other users’ open apps.
Unconfirmed: Sensitive-app counts are Claroc estimates, and SpaceXSI disputes that the publish flow makes open sharing the practical default.
- Paid-account testing found “Anyone with the link” already preselected at publish.
- Claroc estimates 650 to 800 apps contained private data and calls about 2 percent especially bad.
- Thirty other organizations were identified, six of them Fortune 500; names were withheld.
- A Claroc test app added every signed-in Google user to the team before checking membership.
- SpaceXSI says publishing takes several steps and staff accounts default to “Only you.”
Impact: Patient records, plaintext passwords, and internal business data exposed
| Product | Affected |
|---|---|
| SpaceXSI Grok | — |
- 1.Set Grok apps that hold internal data to “Only you” rather than “Anyone with the link.”
From the original article
4 min read at the-decoder.comSecurity firm Claroc found more than 35,000 Grok-built apps open to anyone without login, including patient data and confidential SpaceXSI documents. The cause: "Anyone with the link" was preselected as the default access setting. SpaceXSI took only its own 24 employee apps offline.
By Jonathan Kemper · the-decoder.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.