当初创公司请求免费安全服务时
几周前，我探索了[已编辑]，这是一个获得YC支持的AI后端平台。像许多安全研究人员一样，我倾向于测试新工具，以观察它们如何处理常见的攻击向量。
## 漏洞
*授权缺陷*： [已编辑] 限制免费用户只能使用3个项目，更多则需付费。但他们的API并没有强制执行这一限制。任何人都可以绕过前端，直接调用API。
这个经典的缺陷意味着免费用户可以生成无限内容，付费用户的价值下降，商业模式也随之崩溃。
*用户体验问题*：该平台的导航混乱，设计不一致，层次结构差，工作流程笨拙，入门指导不清。当产品体验如此粗糙时，安全缺陷只是忽视的另一个标志。
## 响应
我在他们的社区频道询问了他们的披露流程。创始人回复道：
“嗨 [姓名]，我刚看到你在公共频道的消息。目前我们不在招聘，但有人在帮助改善平台，这对未来我们招聘时是个很好的测试。如果你想贡献，随时可以向我们报告漏洞或安全问题。如果是安全相关的，最好通过私信而不是公共频道。”
翻译：*请为我们免费做安全工作。也许有一天我们会雇用你。*
## 我为何不披露
我没有透露细节，因为：
- 没有漏洞奖励或认可系统
- 安全研究被框架为“免费测试”
- 对未来考虑的模糊承诺，而不是当前的补偿
- 没有披露政策或时间表
- 整体缺乏专业性
发现并负责任地报告漏洞需要技能。期望研究人员免费为之工作，尤其是来自一家获得资金支持的初创公司，这是不可接受的。
## 更广泛的问题
这反映了一个更大的初创公司问题：希望获得社区的帮助却不愿支付。公司在筹集数百万资金的同时，常常要求无偿的质量保证、安全审计、漏洞报告和用户体验反馈。
## 优秀公司的做法
优秀的公司通常具备：
- 明确的披露政策和定义的时间表
- 漏洞奖励计划（即使是小型的也表示尊重）
- 与研究人员的专业沟通
- 对负责任披露的公开认可
这并不需要太多。即使是10美元的礼品卡和一句感谢也很重要。
## 当前状态
一个月后，漏洞仍未修复，用户体验依然粗糙。
对于用户来说，这意味着不准确的使用跟踪、破裂的经济模型、可能更深层次的问题以及持续的挫败感。对于公司而言，这揭示了一种文化，安全、用户体验和尊重都是事后考虑的事情。
## 对创始人的教训
*安全基础*：
- 在服务器端强制执行所有限制。绝不要信任前端。
- 发布简单的披露政策。
- 尊重研究人员，我们是在试图帮助。
*文化基础*：
- 不要要求免费劳动。
- 将反馈视为有价值的，而不是免费的质量保证。
- 记住，第一印象是持久的。
安全社区希望提供帮助，但不希望以贬低专业知识为代价。
构建安全的产品。创造直观的体验。尊重那些帮助你改进的人。安全债务迅速累积，但用户体验债务则更快地扼杀用户采用。
---
你是否也有类似的经历，AI初创公司期望免费提供安全工作？你是如何处理那些忽视安全的公司的？
查看原文
A few weeks ago, I explored [redacted], a YC-backed AI backend platform. Like many security researchers, I tend to poke at new tools to see how they handle common attack vectors.<p>It didn’t take long to find issues, both in security and user experience.<p>## The Vulnerabilities<p>*Authorization Flaw*: [redacted] limits free users to 3 items, with a paywall for more. But their API doesn’t enforce this. Anyone can bypass the frontend and call the API directly.<p>This classic flaw means free users can generate unlimited content, paid tiers lose value, and the business model collapses.<p>*UX Problems*: The platform also has confusing navigation, inconsistent design, poor hierarchy, clunky workflows, and unclear onboarding. When the product experience feels this raw, security flaws are just another sign of neglect.<p>## The Response<p>I asked in their community channel about their disclosure process. The founder replied:<p>“hi [name], i just saw your message on the general channel. right now, we are not hiring, but people are helping improving the platform and this is a good test for the future, when we will hire people. if you want to contribute, feel free to report bugs or security issues to us. if security related, it's best on private dms rather than on general channel”<p>Translation: <i>Please do free security work for us. Maybe we’ll hire you someday.</i><p>## Why I Didn’t Disclose<p>I withheld details because:
- No bug bounty or acknowledgment system
- Security research framed as "free testing"
- Vague promise of future consideration, not present compensation
- No disclosure policy or timeline
- Overall lack of professionalism<p>Finding and responsibly reporting vulnerabilities takes skill. Expecting researchers to do it for free, especially from a funded startup, is unacceptable.<p>## The Broader Problem<p>This reflects a larger startup issue: wanting community help without paying for it. Companies routinely ask for unpaid QA, security audits, bug reports, and UX feedback while raising millions.<p>## What Good Companies Do<p>The best companies have:
- Clear disclosure policies with defined timelines
- Bug bounty programs (even small ones show respect)
- Professional communication with researchers
- Public acknowledgment for responsible disclosure<p>It doesn’t take much. Even a $10 gift card and a thank-you matter.<p>## Current Status<p>A month later, the vulnerability is still unfixed, and UX remains rough.<p>For users, this means inaccurate usage tracking, broken economics, possible deeper issues, and ongoing frustration. For the company, it reveals a culture where security, UX, and respect are afterthoughts.<p>## Lessons for Founders<p>*Security basics*:
- Enforce all limits server-side. Never trust the frontend.
- Publish a simple disclosure policy.
- Respect researchers, we’re trying to help.<p>*Cultural basics*:
- Don’t ask for free labor.
- Treat feedback as valuable, not free QA.
- Remember that first impressions last.<p>The security community wants to help, but not at the cost of undervaluing expertise.<p>Build secure products. Create intuitive experiences. Respect those who help you improve. Security debt compounds quickly, but UX debt kills adoption even faster.<p>---<p>Have you had similar experiences with AI startups expecting free security work? How do you handle companies that dismiss security?