Anatomy of a CVSS 10.0

The finding

A chatbot embedded on a healthcare provider’s site shipped its API keys in the frontend bundle. Anyone with a browser’s dev tools could extract them — and with them, the ability to message patients in the organization’s name.

(Full writeup pending — the anonymized case exists as a blog post and will be adapted here.)

Why this scores a 10.0

Network vector, no privileges, no user interaction, and the impact crosses from the technical system into patient communication. The scoring walkthrough will go here, metric by metric.

The fix, and verifying it

Reporting is the easy half. This section documents how the fixes were verified after deployment — because “we fixed it” is a claim, not a state.

What it says about compliance labels

The product carried a compliance label. The code contradicted it. Check implementations, not labels.