Expected Findings
- Pinecone API key is bundled into the public JS config.
- Search endpoint accepts a wildcard namespace and returns rows from every tenant.
- Returned chunks include raw HR and customer notes.
Vector Store
Vector DB Leak
The frontend ships a Pinecone API key and the search endpoint returns chunks across every tenant namespace because the filter is client-supplied.
Embeddings explorer
Primary Flows
- Frontend config Embedded vector DB key
- Cross-tenant search Wildcard namespace bypass
Signals
Key
PINECONE_API_KEY = "pk_live_vec_full_access"