Search results

[MASTER] Complete AI Slop Intelligence Dashboard: 15 critical/high findings — fabricated intel, live credentials, unauthenticated Telegram abuse, nuclear targeting data, PII exposure

Status: Open.

#71 In OpenScanAI/GlobeNewsLive;

· tg12 opened on May 28, 2026

No Content-Security-Policy header anywhere — RSS entity decoding + third-party scripts leave XSS fully unmitigated

Status: Open.

#70 In OpenScanAI/GlobeNewsLive;

· tg12 opened on May 28, 2026

In-memory rate limiter non-functional on serverless, trivially bypassed via X-Forwarded-For, and missing from ~25 of 30 API routes

Status: Open.

#69 In OpenScanAI/GlobeNewsLive;

· tg12 opened on May 28, 2026

/api/defcon hardcodes DEFCON 3 with lastUpdated: new Date() — classified military level misrepresented as live open-source intelligence

Status: Open.

#68 In OpenScanAI/GlobeNewsLive;

· tg12 opened on May 28, 2026

/api/live-streams hardcodes internal CDN HLS URLs for Sky News, Al Jazeera, DW, and France 24 — unauthorised live stream redistribution

Status: Open.

#67 In OpenScanAI/GlobeNewsLive;

· tg12 opened on May 28, 2026

/api/signals FALLBACK_SIGNALS injects fabricated CRITICAL war events attributed to Reuters and Al Jazeera — triggers real Telegram notifications on RSS failure

Status: Open.

#66 In OpenScanAI/GlobeNewsLive;

· tg12 opened on May 28, 2026

Unauthenticated /api/health-proxy actively strips X-Frame-Options and CSP from upstream responses and serves third-party HTML under application origin

Status: Open.

#65 In OpenScanAI/GlobeNewsLive;

· tg12 opened on May 28, 2026

typescript: ignoreBuildErrors: true silently suppresses all type errors in production builds — type safety fully disabled

Status: Open.

#64 In OpenScanAI/GlobeNewsLive;

· tg12 opened on May 28, 2026

next.config.mjs wildcard Cache-Control: public applied to all /api/* routes including notification, alert, and Telegram endpoints

Status: Open.

#63 In OpenScanAI/GlobeNewsLive;

· tg12 opened on May 28, 2026

5 endpoints (/api/fires, /api/outages, /api/supply-chain, /api/displacement, /api/kalshi) return fabricated data attributed to NASA, UNHCR, Kalshi, NetBlocks with no disclosure

Status: Open.

#62 In OpenScanAI/GlobeNewsLive;

· tg12 opened on May 28, 2026

Unauthenticated /api/infrastructure serves nuclear weapons facility coordinates, ICBM sites, undersea cable routes and an IRAN_TARGETS layer to anyone

Status: Open.

#61 In OpenScanAI/GlobeNewsLive;

· tg12 opened on May 28, 2026

Unauthenticated /api/alerts is a public Telegram spammer and SSRF relay — action:test sends to any user, action:create webhook hits any URL

Status: Open.

#60 In OpenScanAI/GlobeNewsLive;

· tg12 opened on May 28, 2026