GET RID OF UNSAFE CALLBACKS IN createUser FUNCTION!!! (could have exposed data to unauthorized people)
Ethan
Author
Luckily it wasn't in production yet. Some of the callbacks included objects from Stripe. Because you can call the function without authorization, someone could have gotten a user's Stripe info based on their email address. Not credit cards, but details about their subscriptions.
Please sign in to leave a comment.