> Nov 29: Writer responds, asking for more details
> Nov 29: We respond describing the exploit in more detail with screenshots
> Dec 1: We follow up
> Dec 4: We follow up with re-recorded video with voiceover asking about their responsible disclosure policy
> Dec 5: Writer responds “We do not consider this to be a security issue since the real customer accounts do not have access to any website.”
> Dec 5: We explain that paid customer accounts have the same vulnerability, and inform them that we are writing a post about the vulnerability so consumers are aware. No response from the Writer team after this point in time.
Wow, they went to way too much effort when Writer.com clearly doesn't give a shit.
Frankly I can't believe they went to so much trouble. Writer.com - or any competent developer, really - should have understood the problem immediately, even before launching their AI-enabled product. If your AI can parse untrusted content (i.e. web pages) and has access to private data, then you should have tested for this kind of inevitability.