Show HN: Open-source self-hostable backend – try to break my live instance (48h) | Hacker News Reader

Show HN: Open-source self-hostable backend – try to break my live instance (48h)

So I've been working on this open source project called Nuvix for a while now — it's basically a self-hostable backend with auth, database, file storage, and a unified API all bundled together.

Anyway, I spun up a live instance on the cloud and figured instead of just asking for feedback the usual way, why not just... let people in and see what happens.

So here you go: Dashboard: https://studio.kraz.in Login: email: test@kraz.in password: testpass

You've got 48 hours. Poke around, break stuff, do your worst. If you find something weird or something that breaks, drop it in the comments or open an issue on the repo — https://github.com/nuvix-dev/nuvix.

Genuinely curious to see what people find. Be brutal.

View on HN

Nicely built.

Can you try running any sql query? Like "select count(*) from todos"? Seems connection limit has reached.

Also, tables are not getting listed as well. Just the cached ones are getting listed, that too go away within few seconds.

'Failed to execute SQL: too many connections for database "postgres"'

There are some extremely concerning security vulnerabilities in this project that even the weakest of hackers could exploit.

Is this product a ragebait/troll?

1) Account takeover of any user with just their email: POST /v1/account/recovery with any user's email, the API response gives you the plaintext recovery secret. Call PUT /v1/account/recovery with that secret + a new password. You now own their account. No email inbox access needed. Two curl commands.

2) Password hashes returned by the API: GET /v1/users with any API key returns every user's full argon2 hash, algorithm, and tuning parameters. tested and got $argon2id$v=19$m=65536,t=3,p=4$... for test@kraz.in.

3) CORS reflects any origin with credentials: Send Origin: https://evil.com to any endpoint — server responds with Access-Control-Allow-Origin: https://evil.com + Access-Control-Allow-Credentials: true. Any website on the internet can silently read authenticated API responses from logged-in users

There is literally like 50 more of these though. The author probably didn't spend more than 5 minutes on security hardening.

You know why connections have exhausted? Because I issued this: "ALTER DATABASE postgres CONNECTION LIMIT 0;"

Nice UI, but same security vulnerabilities as I've seen typically found in vibe-coded projects.

Reply on news.ycombinator.com