Patrick Foster

mintlify engineering

[rohan @rohandevs]

introducing @tesser_sh (YC W27)

tesser is the simplest way to offload heavy workloads like dev servers and builds to cloud VMs. every worktree gets its own machines, with automatic port forwarding to your laptop

[Patrick Foster @patrickrfos]

@densumesh our sales team would love to speak to your employer

[Patrick Foster @patrickrfos]

https://t.co/FLHGG2LWd6

[Patrick Foster @patrickrfos]

@nikhilville @david_rosenberg @varadh hello - appreciate you all fighting back against the slop

[Patrick Foster @patrickrfos]

@CasaDePorter this effectively what happens today with mintlify's mcp. all docs content is hosted on a turbopuffer like product which is used for searching through the docs. the latter problem is the far trickier one

[Patrick Foster @patrickrfos]

https://t.co/q13q9LGTO7

[Patrick Foster @patrickrfos]

that last 20% is essential but requires an order of magnitude more compute to do well. some changes are behind a feature-flag, require many stakeholder to review, code is spread across a dozen code PRs, and context is required from comms only in slack.

doing the tail end tastefully is where the problem gets exciting.

[Patrick Foster @patrickrfos]

@handotdev in hindsight, it is obvious that internal wikis should be stored in a git-backed file structure

[Han Wang @handotdev]

https://t.co/25idcIpB34

[Patrick Foster @patrickrfos]

@JoshARosen @kartikb753 agreed! solving docs going stale is a core part of the problem

[Patrick Foster @patrickrfos]

@milancermak interesting! i see this as a different equally valid solution to the same problem. i don't think these solutions are mutually exclusive though

[Patrick Foster @patrickrfos]

@CasaDePorter if this is the case, then the problem hasn't been solved well. a core competency is that agents can efficiently parse the information

[Patrick Foster @patrickrfos]

@JAS0Nduncan interesting! will read it today

[Patrick Foster @patrickrfos]

@zomeha38 the problem has a high ceiling to solve well and this is a core part of it

[Patrick Foster @patrickrfos]

@hahnbeelee @hunterchen_7 yeah - all the seats at the restaurant were taken so i had to eat at office

[Patrick Foster @patrickrfos]

@DanielWolkowitz we just have to execute

[Patrick Foster @patrickrfos]

@hunterchen_7 hiii

[Patrick Foster @patrickrfos]

@hahnbeelee @leylndd your not even in the channel

[Han Wang @handotdev]

We just raised a $45M Series B at a $500M valuation led by @a16z and @SalesforceVC to build the knowledge infrastructure for AI

[Han Wang @handotdev]

Over the past few days, I asked our team to intentionally stay away from social media to focus on our customers.

We put out an initial statement from our blog, but did not draw enough attention to it.

Now that the dust has started to settle, I want to share our perspective on what happened.

What happened?

We messed up. We overlooked a foundational design flaw that put many of our customers at risk. This was a serious mistake, and we take full responsibility.

It is our duty to holdup high security standards, and we failed to meet those standards. We should have known better and done better.

The timeline of events

On November 12, 2025, we were notified that security researchers discovered a cross-site scripting vulnerability.

This meant that a static asset (images, pdfs, svgs, etc...) that gets uploaded to one customer's project could be accessed from another customer’s domain.

All alarm bells went off.

Within 45 minutes of being notified, we deployed a fix to production and immediately began auditing all assets across our entire platform.

While we did not uncover any exploitation through this vulnerability, we contacted every possible at risk customer by 10:25 PM that day.

Over the following weeks, we’ve worked with the researches, to not only address the initial vulnerability, but to identify and fix several others.

The people who helped us

I want to thank @xyz3va, @MDLcsgo, and @hackermondev, who brought this issue to our attention and worked alongside us over the past few weeks to not only to fix the issue, but make our vulnerability known to strengthen better security practices everywhere.

I am genuinely grateful for their work in helping us secure our systems.

What we're doing now

We're expanding our bug bounty program (linked below) significantly, and continuing to put resources in our security infrastructure and practices. This incident made clear that we need to do more, and we will.

To our customers: thank you for your patience and your trust. We know trust is earned, and we're committed to earning it back.

- Han