What the evidence supports.
- Observed access
- Anonymous read access
- Recorded profile count
- 974,868
- Write operations
- Blocked in the reported checks
- Administrative access
- Blocked in the reported checks
- 01 / 11 OCT 2026
Finding documented
The founder-authored report records read access and the count from response metadata.
- 02 / DATE NOT RECORDED HERE
Reported to the operator
The founder states the finding was disclosed. No disclosure receipt is published on this page.
- 03 / FOUNDER-REPORTED OUTCOME
Patch and reward
The founder reports remediation and a reward. This statement is separate from the technical observations.
- 04 / 18 OCT 2026
Later scoped assessment
A later report records no confirmed qualifying database-access finding in its tested scope. It is not a comprehensive or independent certification.
No website was retested to build this evidence panel. The historical reports establish scoped observations; they do not certify current security or imply ForgeGUI endorses VEYRSEC.
The reported finding
A VEYRSEC founder-authored report dated 11 October 2026 records anonymous read access to 974,868 ForgeGUI user-profile records. The count was recorded from the database API’s response metadata. Profile information and subscription-plan fields were accessible without signing in.
This was a read-only permissions issue. The report states that write operations and administrative paths were blocked. It does not establish SQL injection, remote code execution, password disclosure, or an administrator takeover.
Why it mattered
Information that is available inside an application is not automatically intended for anonymous bulk access. Profile details combined with account-plan information can reveal more about customers than a public profile page was meant to share. Access should be evaluated field by field and role by role.
The underlying lesson
A browser-visible public API key can be intentional. The security boundary is what the backend permits that anonymous role to read or change. Hiding a public key does not replace database grants and row-level access policies.
The report recommended narrowing anonymous access and enforcing ownership checks for private profile data. A fix should preserve legitimate public features while removing access that the application does not require.
Disclosure and later testing
The founder reports that the issue was disclosed, patched and rewarded. A separate later assessment records no confirmed qualifying database-access finding in its tested scope. That later result should be read alongside its date and limitations, rather than treated as a guarantee about the entire application.
Evidence limits
This is a redacted account of the founder’s reports, not an independently certified audit or an endorsement from ForgeGUI. Raw records, keys, access paths and reproduction instructions are withheld. No target was retested while preparing this page. Current security depends on the application’s current version and configuration.
A website check.
A clearer picture.
Start with a $10 initial check. Critical-finding fees from $100, agreed up front.