HackerTrans
TopNewTrendsCommentsPastAskShowJobs

garyhtou

no profile record

Submissions

Audit Tool for Vercel Exposure of Environment Variables

github.com
4 points·by garyhtou·3 miesiące temu·1 comments

Show HN: HCB – Nonprofit financial app processing $6M/month

hackclub.com
9 points·by garyhtou·7 miesięcy temu·1 comments

comments

garyhtou
·3 miesiące temu·discuss
Audit tool for the Vercel April 2026 security incident. I work at Hack Club, and our Vercel team has 400+ projects and 750+ environment variables.
garyhtou
·7 miesięcy temu·discuss
Hi @cirrus3,

You've found an optional feature called Transparency Mode!

I admit, this is A LOT of information being made accessible. We at Hack Club (the nonprofit organization behind HCB, and the owner of the transactions above) have chosen to make our finances publicly available on the internet. You can read more about it here: https://blog.hcb.hackclub.com/posts/transparent-finances-opt...

That link (https://hcb.hackclub.com/hq/transactions) shows our donations and spending down to the cent since we believe donors deserve to know what their contributions are funding. As a nonprofit, you can talk about what you’re spending money on, but transparency in every transaction builds trust for supporters. This level of transparency is definitely atypical, and I can see why it may raise concerns.

Other organizations using HCB (such as Reboot) can choose to enable this feature too (it's off by default), and they're briefed on the potential risks and level of exposure to decide whether it's right for their organization/team. HCB supports 6.5k nonprofits, and roughly 64% of organizations have chosen to enable this feature.

> I see partial account numbers and other IDs/numbers that I assume you'd prefer not be public, regardless of how insensitive they may seem now.

> EXPENSIFY, INC. VALIDATION XXXXXX5987 THE HACK FOUNDATION +$0.89

Good catch! Thanks for flagging that verification deposit. I've pushed a fix here: https://github.com/hackclub/hcb/pull/12336

As for the account numbers (e.g. XXXXXX5987) visible in some transactions, these are our own defunct operating accounts, and we're aware they're out there on the internet. We have a new way of managing account numbers via Column.com, so these older transactions are less of a concern for me.

I very much appreciate you bringing these to my attention! We're always looking to improve, so I'd love to hear if you find anything else.
garyhtou
·7 miesięcy temu·discuss
Hi there! Gary here from HCB (Hack Club's fiscal sponsorship program).

Sorry about that! I've just pushed a fix for one of those errors. Although I wasn't able to reproduce this donation behavior on Chrome, I will continue investigating.

I appreciate you reporting this!
garyhtou
·7 miesięcy temu·discuss
I love seeing PSF support the community with fiscal sponsorship! It makes such a huge difference for these open source projects and meetups, letting them focus on software and community rather than the legal/financial back-office work.

Hack Club's been a fiscal sponsor for about 7 years now (since 2018), and it's evolved quite a bit since the early days. I run engineering & product for the fiscal sponsorship program there and would be happy to chat/share any tips!

oh, and while it's on my mind, the codebase was open-sourced earlier this year (https://news.ycombinator.com/item?id=43519802), and we just launched a mobile app yesterday! https://news.ycombinator.com/item?id=46130402
garyhtou
·7 miesięcy temu·discuss
It's time! Take a look at the new mobile app for HCB. It's built with Expo by a 17-year-old! https://hackclub.com/fiscal-sponsorship/mobile-app/