Most of the 43,601 apps published through SpaceXSI's Grok Build could be opened by anyone, with no login, according to researchers at Claroc.
Grok Build lets users describe an app in a chat-style interface and publish it from the same window, without writing code. Each app gets an address made of four random words under grok.me, which works as a privacy measure because nobody can easily guess it. Claroc found the addresses anyway, using passive DNS services, which index domain names observed in DNS traffic. An app was discoverable even if its creator never shared the link. Of the 43,601 addresses the researchers identified, 35,578 could be accessed without authentication.
Publishing offers three choices: "Anyone with the link", "Invited Users" and "Only You". Claroc said the first is the default.
Most of what the researchers found was harmless, such as games, calculators and landing pages. But one in 10 apps held sensitive or internal business information, and 2% exposed material serious enough for a high or critical severity rating. Examples included a hospital employee directory with more than 3,500 names, an intensive care briefing with patient information, and a trucking company's recruitment database of more than 1,000 people. One employee timesheet app had downloadable code containing 18 accounts with plaintext passwords, administrator credentials among them.
SpaceXSI's own material leaked too. Claroc found 24 open apps holding onboarding plans, employee name lists, a sales territory map of almost 600 strategic accounts, and media plans with budget tiers, including one for a US federal agency marked confidential. Only one app asked for a password, an archive of a streaming service's ad measurement studies.
Claroc also built two test apps. One let unauthenticated visitors modify a shared contact database. The other granted access to anyone who signed in with a Google account, whether or not they belonged to the team.
The researchers notified SpaceXSI on November 8, and within two days its own apps were no longer available. Notification of other app owners is under way.
A random address is an unguessable name, not a lock, and publishing it to a public DNS record turns it into a listing. The sharing menu resembles the one in Google Docs, but a shared document is mostly text, while these apps held databases and code. That raises a question for any chat-to-app tool: who checks the sharing settings when the person publishing never wrote the app?