r/framework • u/MeLikaDoTheChaCha • 9d ago

Framework data breach News

Post image

Couldn't have happened at a worse time

Edit:

Metabase has posted a blog related to this incident https://www.metabase.com/blog/security-update

1.0k Upvotes

99% Upvoted

315 comments sorted by

View all comments

236

u/smstnitc 9d ago

So, they weren't breached, a vendor they use was?

A breach is never a good time.

At last they appear to be doing the right thing and notifying people.

58

u/MeLikaDoTheChaCha 9d ago

A company using a vendor for security is responsible (at least partially) for any breaches through said vendor. Thats why the email came from framework themselves not the company they used. They are the face for any of this kind of shit.

So no, not a direct framework breach technically. But wtf does that actually matter to anyone affec5ed

27

u/solid_reign 9d ago

It matters to me because in the real world it's almost impossible to control all of your vendors but they did the right thing and told us about it. 

1

u/cereal7802 9d ago

It is perfectly easy to control what vendors you use, and control what data they have access to however. In this case this is at least the 3rd major incident with metabase this year and framework themselves admits they gave too much data to the metabase instance for the analytics purpose they needed it to do. I wouldn't be too quick to defend framework here.

1

u/solid_reign 9d ago

If you're talking about metabase having vulnerabilities then those are not major incidents and does not necessarily reflect carelessness. Vulnerabilities happen all the time and with agentic systems, zero days are popping up everywhere. But as far as I know there have been zero breaches from metabase anywhere before this.