Key Themes from the Hacker News discussion
| # | Theme | Illustrative Quote |
|---|---|---|
| 1 | Mass exposure of highly sensitive personal documents – tax returns, SSNs, IDs, and other PII are publicly indexed by Google. | > “Wow, surprised this isn’t blowing up more. Leaking form 1040s is egregious, let alone getting them indexed by Google…” – wxw |
| 2 | Fiverr’s inadequate security response and denial of the breach – the company downplays the incident and claims it’s “normal user sharing.” | > “To be clear, this is not a cyber incident. Fiverr does not proactively expose users’ private information…” – official Fiverr statement (summarized by several users) |
| 3 | Demand for regulation & professional certification for anyone handling large‑scale PII – many argue that software engineers who work with sensitive data should be licensed and held accountable. | > “Jobs with access to/control over millions of people's data should require some kind of genuine software engineering certification, and there should be business‑cratering fines for something as egregious as completely ignoring security reports.” – applfanboysbgon |
| 4 | Technical suggestions for immediate remediation – sign URLs, enforce authentication, switch Cloudinary uploads to “authenticated” mode, etc. | > “The Cloudinary fix … generate a signed URL server‑side, set sign_url=true for logged‑in users, and switch the asset type to authenticated. Once the URL is signed, the public version stops resolving, killing the indexed copies.” – viaredux |
The summary captures the four dominant topics: the scale of the data leak, Fiverr’s feeble reaction, calls for stricter professional accountability, and concrete technical steps to close the exposure.