{"id":164,"date":"2026-10-29T07:13:17","date_gmt":"2026-10-29T07:13:17","guid":{"rendered":"https:\/\/bugskan.com\/?p=164"},"modified":"2026-10-29T07:13:17","modified_gmt":"2026-10-29T07:13:17","slug":"wiz-found-a-misconfigured-moltbook-database-exposing-tokens-and-private-messages","status":"publish","type":"post","link":"https:\/\/bugskan.com\/index.php\/2026\/10\/29\/wiz-found-a-misconfigured-moltbook-database-exposing-tokens-and-private-messages\/","title":{"rendered":"Wiz found a misconfigured Moltbook database exposing tokens and private messages"},"content":{"rendered":"<p>Wiz reported finding a misconfigured Supabase database used by Moltbook, a social platform for AI agents. The researchers said the configuration allowed read and write access to platform data, including authentication tokens, email addresses and private messages.<\/p>\n<p>Wiz reported approximately 1.5 million tokens and 35,000 email addresses in the exposed data. Those counts should not be interpreted as 1.5 million distinct human users or proof that criminals obtained every record.<\/p>\n<p>According to Wiz, the Moltbook team secured the database within hours of disclosure. The practical lesson is to enforce authorization at the database layer and rotate exposed credentials; model providers mentioned by the platform are not automatically affected vendors.<\/p>\n<p><a href=\"https:\/\/wiz.io\/blog\/exposed-moltbook-database-reveals-millions-of-api-keys\">Read the original source<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The researcher-reported exposure involved Moltbook\u2019s database access rules, with the team securing it after disclosure.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"bugskan_incident_id":"inc_97a43b617203e7","bugskan_event_type":"breach","bugskan_response":"REVIEW","bugskan_technical_severity":"","bugskan_technical_severity_source":"","bugskan_evidence_quality":"high","bugskan_affected_scope":"Moltbook\u2019s misconfigured database as described by Wiz.","bugskan_recommended_next_step":"Review any incident guidance and rotate credentials confirmed exposed through the platform.","bugskan_who_should_check":"","bugskan_material_updated_at":"","bugskan_reviewer_name":"","bugskan_reviewed_at":"","bugskan_legacy_state":"mapped","bugskan_featured":false,"bugskan_sample":false,"footnotes":""},"categories":[1],"tags":[],"bugskan_format":[2],"bugskan_technology":[47],"class_list":["post-164","post","type-post","status-publish","format-standard","hentry","category-uncategorized","bugskan_format-security-brief","bugskan_technology-moltbook"],"_links":{"self":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/164","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/comments?post=164"}],"version-history":[{"count":1,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/164\/revisions"}],"predecessor-version":[{"id":364,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/164\/revisions\/364"}],"wp:attachment":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/media?parent=164"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/categories?post=164"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/tags?post=164"},{"taxonomy":"bugskan_format","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_format?post=164"},{"taxonomy":"bugskan_technology","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_technology?post=164"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}