SpaceXSI coding platform exposes confidential documents from thousands of users

A design flaw in SpaceXSI's Grok Build coding tool exposed sensitive information from thousands of users, including proprietary materials belonging to SpaceXSI itself. Claroc estimated that roughly two percent of the exposed apps contained material serious enough to rate as high or critical severity. [1][2]

The vulnerability stemmed from how Grok Build formatted its web addresses. Although the platform generated randomized four-word phrases with up to 38 bits of entropy to secure links, developers placed those phrases to the left of the domain name as subdomains rather than in the URL path. This structural choice allowed passive DNS servers to log the addresses into searchable public databases. Claroc noted that nearly all of the exposed apps lacked password protection, enabling anyone with the link to view internal employee records, advertising proposals, and operational checklists. [1][2]

SpaceXSI's own exposed files included an onboarding plan for its enterprise sales team, a sales territory map covering 594 strategic accounts, eight X advertising proposals, and two copies of an X brand safety playbook. Claroc reported that SpaceXSI only responded after researchers tagged Elon Musk and another company official on X. SpaceXSI subsequently took down 24 of its own exposed applications, though Claroc stated that the company had not removed vulnerable apps created by other organizations. [1][2]