AI-coded App Left 59 Open Vulnerabilities, and Open Access to Critical Interview Data

COMPANY DESCRIPTION

VC-backed AI VoiceAgent platform built entirely using Replit's AI coding assistant to help professionals prep for stakeholder interviews using voice-based simulations, autogenerated documents, and smart prompt creation.

Perfai Security's Role

Autonomous app testing across 71 endpoints. Exposed paths including live interview transcripts, project documents, Replit prompt generators, and patchable interview notes. All flagged and auto-fixed by Perfai Security's agentic models.

App Count

Endpoints

Vulnerabilities

Critical

High

What we found, in plain English

Anyone with a link could read every candidate's private interview transcripts and uploaded documents. Those files contain names, resumes, and personal details — exactly the kind of data that triggers privacy complaints and compliance penalties.
The AI assistant's internal instructions could be pulled out by anyone who asked the right way. Those prompts are the product's core intellectual property, and once copied they can be reused by a competitor for free.
A stranger could edit or delete another user's interview sessions, notes, and coaching data. The app never checked whether the person making the change actually owned the data, so records could be altered or wiped without a trace.

Full technical findings

Exploitable Surfaces & Risks

User-Uploaded Documents
Sensitive data including PII
Interview Sessions
Metadata, schedules, participant names
Internal Logs and Coaching data
Personalized advice and sensitive user context
Direct Leakage of Prompt Engineering Logic
Critical intellectual property and prompt chains
Transcripts of Voice Interviews
Reputational, legal, and compliance implications
Privilege Escalation
Altering and injecting data
Live or Stored Voice Conversations
Violating user trust and voice privacy

Perfai Security Testing Categories

OWASP API Security Top-10 List
OWASP Web Top-10 List
Perfai Security Next-Gen Top-30 List
OWASP Business Logic Top-10 List
OWASP Mobile Top-10 List
OWASP AI Agent Top-10 List

Estimated Breach Cost With:

50 Customers | $455,000

See what Perfai Security finds in your app

Paste a URL. Get a free security report in minutes.

Start Free →