Patrick Foster

We just raised a $45M Series B at a $500M valuation led by @a16z and @SalesforceVC to build the knowledge infrastructure for AI

Over the past few days, I asked our team to intentionally stay away from social media to focus on our customers. We put out an initial statement from our blog, but did not draw enough attention to it. Now that the dust has started to settle, I want to share our perspective on what happened. What happened? We messed up. We overlooked a foundational design flaw that put many of our customers at risk. This was a serious mistake, and we take full responsibility. It is our duty to holdup high security standards, and we failed to meet those standards. We should have known better and done better. The timeline of events On November 12, 2025, we were notified that security researchers discovered a cross-site scripting vulnerability. This meant that a static asset (images, pdfs, svgs, etc...) that gets uploaded to one customer's project could be accessed from another customer’s domain. All alarm bells went off. Within 45 minutes of being notified, we deployed a fix to production and immediately began auditing all assets across our entire platform. While we did not uncover any exploitation through this vulnerability, we contacted every possible at risk customer by 10:25 PM that day. Over the following weeks, we’ve worked with the researches, to not only address the initial vulnerability, but to identify and fix several others. The people who helped us I want to thank @xyz3va, @MDLcsgo, and @hackermondev, who brought this issue to our attention and worked alongside us over the past few weeks to not only to fix the issue, but make our vulnerability known to strengthen better security practices everywhere. I am genuinely grateful for their work in helping us secure our systems. What we're doing now We're expanding our bug bounty program (linked below) significantly, and continuing to put resources in our security infrastructure and practices. This incident made clear that we need to do more, and we will. To our customers: thank you for your patience and your trust. We know trust is earned, and we're committed to earning it back. - Han