r/canadaguns • u/TescoValueSoup • 26d ago
Announcement FYI - Canadianfirearmsexchange.ca security vulns and shortcomings, data handling dishonesty and AI usage.
Posting with approval from the Mod team
Post flaired as Misc, couldn't find something else suitable.
I am creating this post so you can make an informed decision before signing up to this website.
Since it was shared on Monday I have been looking in to the canadianfirearmsexchange website and its creator. Original post
I have found in probing the website that not only is it scattershot with poorly implemented or unfinished features, more concerningly I don't believe he has been upfront about how the site has been created or how he's handling and storing user data.
1) His admin routes are discoverable
The client bundle lists routes including:
• /admin/users
• /admin/listings
• /admin/etransfers <----- THIS**
• /admin/contact
• /admin/reports
• /admin/broadcast
• /admin/members/$userId
**He IS collecting users etransfer information, despite saying around the website that "We never collect or store credit card or banking details."
His Supabase project ID is exposed
• Supabase project ID: [removed] - Shown to CanadaGuns mods privately
• Numerous administrative route names and server-function identifiers are exposed too
2) Analytics runs before consent checks. Opt-out doesn't opt-out
The privacy policy says analytics cookies are used “with your consent,” and the banner offers “Essential only.” However, /~flock.js is inserted unconditionally into every page.
It records:
• Full page URL and path
• Referring page
• Browser user-agent
• Preferred language/locale
• A country estimate derived from your timezone
• Timestamp and session ID
• Tracks navigation
• Exposes window.Tinybird.trackEvent(...), allowing the site’s other code to submit custom analytics events.
The site has a second, consent-aware analytics implementation that checks cfe_cookie_consent_v1, but the separate Flock script does not perform that check. Choosing “Essential only” therefore does not to stop all analytics.
Knowingly, or unknowingly he is tracking his users and they can’t opt out of it,.
I wont attribute to malice that which is adequately explained by stupidity, but in this case, both are really bad for a guy claiming to have 30 years of IT experience and raises questions about how experienced the site’s creator actually is.
3) The site lacks any anti-clickjacking protections
The sampled responses did not include either:
• Content-Security-Policy: frame-ancestors none'
• X-Frame-Options
Meaning an attacker could potentially place the site inside an invisible or deceptive iframe and trick a signed-in member into clicking message, listing, or account controls.
4) Finally, and in some ways the most damning of all. The site has been made using Lovable, an AI service.
• The homepage’s Open Graph image contains a Lovable project identifier ending in .lovable.app.
• Image paths use Lovable’s /__l5e/assets-v1/… infrastructure.
• The JavaScript explicitly references:
• window.__lovableEvents
• .lovableproject.com
• .lovable.app
• .lovable.dev
Using Lovable does not itself make the site unsafe. The concern is whether someone competent has reviewed the generated application, backend authorization, privacy model, and operational controls.
I would argue it hasn't been human-reviewed, because of everything I outline above.
People are being asked to submit their real names, providing their location data and addresses (or having it scraped) and a wealth of metadata when they use this.
Not only that, submit an etransfer payment as part of the identification verification process.
And his "geo-protections" are amateurishly done by looking up your IP using IPAPI(dotcom).
For all intents and purposes, barring the actual firearm serial numbers - he is creating alarmingly invasive and private registry of all his users. He is handling their data badly, all while saying he isn't.
TLDR;
This website tracks you even when you opt out.
The site admin is collecting a wealth of information on you, but is saying he isn't (I just cant confirm the extent of the information being collected.)
The site is made with Lovable an AI service, and uses Tinybird(Flock.js), Supabase and a limited application of Cloudflare to handle your data.
This site is a bad actors dream, I would not recommend anyone submit their personal information to it.
-TVS
23
u/Sad-Stop-2401 26d ago edited 26d ago
I am also a kinda sorta may be software guy. So here are some of my reactions to this. Please note, I have not even spent 2 mins looking into this website beyond their privacy policy and likely will NEVER use such site because... well the name of the site is rather .... akward.... CanadianFirearmSexChange. I rather have nothing to do with folks who want to sex change my beloved guns. They are my beauties! Hands off mister!
Jokes apart, I expect a serious operator of such business to spend a little more effort in naming their business.
So many names to choose from!
Anyhoo... on the technical merits.
- Having a route in bundle is not such a damning evidence unless u/TescoValueSoup discovered something even more sinister hiding behind the route. Just because he has a route does not mean he is collecting payment info. It could be simply a dead route amounting to nothing or could be a etransfer for something totally unrelated. Its not quite the smoking gun that we are looking for. Admin console can allow etransfer for the site services while client payments might be taken care of by a totally different payment processor. (Again, I have not really used the site).
- Supabase project ID is designed to be a public id and is not expected to be hidden.
- Likewise server function identifiers are not supposed to be hidden.
- What is rather needed is that access to such things is gated by strong authentication and authorization mechanism and defended using rate limiting where needed. I have not heard if u/TescoValueSoup has discovered something of that nature. The above two are not evidence of vulnerability IMHO. At worse it shows potential attack surface.
- On the same lines, I will be wary about how much a server function exposes. Again I have not seen any of that being claimed. By this I mean if a server function takes a complete query as input (and believe me some implementations that I have seen and generated by AI at time do that!), the function can divulge WAY more than what you will like. Or sometimes the functions expose way more fields of a DB than needed and leaks info that should not be leaked.
- Yes, collecting analytics is sneaky. Yes, it shows atleast incompetence if not malice. Yes, this is a smoking gun indeed. In his defence, it could just be the platform he built on doing this. Or a mistake of not removing this tracking functionality. It is especially damning when you are trying to build trust. It does show sloppy technical work to say the least.
- While click jacking is indeed a problem, I will not classify it as acute as it is being described. It means someone can overlay this website with something else and decieve users into clicking some legit controls on this website. There can be structural defense against this (like re-authenticating before any dangerous action instead of relying purely pre-authenticated session). Still in the pantheon of dangers, this is still far fetched. There are bigger dangers like XSS, SQL injection etc that I will be vary of. That being said, putting two headers in your _headers or vercel.json file or whatever you got should not be that hard.
- I do not think the damning part is that this site was made using loveable. There are certainly better tools for the task (ClaudeCode + your own Github CICD pipeline to deploy on say ... netlify? come to mind). Also, I do not think using AI for code generation is a damning thing in 2026. Heck a simple query in ClaudeCode or a simple skill can actually be a great starting point for auditing your web app. Provided you know what you are doing. This and using supabase are not the worst sins, though I would not have used them. The damning part is elsewhere.
- The BIGGEST damning part is he does not disclose where he is storing your private data that is exposed to his website! https://canadianfirearmsexchange.ca/privacy . For someone dealing in firearms, it is necessary to tell its users where their data is being stored? As in which country, which company. It helps people to make an informed decision if they should use your platform or not. I think but not certain it is also a requirement of PIPEDA and BC PIPA. I will be upfront about where I am storing my visitor what data and who accesses it and who processes it. I will tell them I am using supabase and their backend as a service can store and process my data say in US. Or for instance, I will not like someone's name etc to be stored or accessible in a country that can be hostile to them. This software supply chain risk IMHO is bigger than all of the above for firearms owners. Especially because the community and hobby attracts people with diverse political opinion and they are judged for their opinions in the light of their ownership of firearms. I will like to know for instance if they use Zohomail (I do not know what email service or mailer they use) to process email communication, with Zohomail having potential data storage and/or administration done in India because it is headquartered in India.
3
u/ChaoticDNA 26d ago
Let's be serious - unless the data is stored at a sovereign data center, your data is at risk.
39
22
u/Disastrous-Panic-87 26d ago
Thanks for the info.
14
u/Parking_Media 26d ago
Username ironically relevant to the topic.
People vibe coding stuff is rad until it super duper isn't.
5
u/LeviathanOfLiberty 26d ago
30+ years of IT experience btw
3
u/RoundBottomBee 25d ago
TBH, I have 40y experience and I wouldn't know what 90% of that means w/o context. Because my 40y is in sysadmin. Context matters.
16
u/starw24-ps4 26d ago
I was gonna stick with gunpost anyways, but glad to know about this. Thanks for doing the research!
13
7
14
3
u/22GageEnthusiast 26d ago
Funny, cuz I just checked out the site earlier today and I was like meh I'll stick to Gunpost lol
3
6
3
4
u/Relevant_Diver_3228 26d ago
I dont know what most of this means but from my understanding he is lying and gathering out information after saying he wasn't. Am I correct?
2
u/Geralt-of-Rivai 26d ago
Dammit I just finished doing my verification for the site and sent the e-transfer. So should I just stick to gunpost
2
3
7
u/IWILLGUTYOU 26d ago
His admin routes are discoverable
The client bundle lists routes including...
So are every website you've ever used. Are the backend routes protected with an ACL? You failed to include that. Why?
Analytics runs before consent checks. Opt-out doesn't opt-out
Alright so is basically every website because they all use Google Analytics.
The site lacks any anti-clickjacking protections
The sampled responses did not include either:
• Content-Security-Policy: frame-ancestors none'
• X-Frame-Options
Meaning an attacker could potentially place the site inside an invisible or deceptive iframe and trick a signed-in member into clicking message, listing, or account controls.
You think posters of listings can insert iframes or any html content? Iframes in user content haven't been a thing since Vbulletin and myspace days.
I'm not even going to comment about the vibe coding because this a clearly vibe'd security review.
Source: 15 years of offensive security and software engineering.
13
u/Cager_CA 26d ago
Which RCMP detachment did you write this out of
0
u/IWILLGUTYOU 26d ago edited 26d ago
From Charlottetown PEI with my 15 year old reddit account chief queef. You can have valid statements about a new websites but maybe dont use AI to hallucinate security vulns that arent there.
Edit: it's honestly insane that you and OP BOTH have had your pals less than 2 years but accuse other people of being feds lmafo
4
1
u/Sad-Stop-2401 26d ago
Clickjacking is a rather interesting thing. What he means is that someone could put a iframe or similar having CanadianFirearmSexChange.ca in an attacker website and trick user in clicking something on CanadianFirearmSexChange.ca that they did not intend. Since the browser may have a session live on CanadianFirearmSexChange.ca it could be deleting a listing or similar. There are headers that instruct browsers to not let that happen.
1
1
u/TescoValueSoup 26d ago
I completely take your point about iframes, if we’re talking about a competent developer. Which we are not.
And for the analyics, again yes you’re right if the site uses Google analytics they’re there but that’s not what the point was. The facts are that this guy claims to not track users, says you can opt out; and it doesn’t work so continues to track you. All while claiming he’s compliant and has people’s privacy in mind
5
u/IWILLGUTYOU 26d ago edited 26d ago
For the record and reddit at large, do you have any actual security flaws to report or is this post basically at best a complaint about tracking/cookies of users on a gun website happens to be the same you experience everywhere else which could be against what they advertised?
The title of this thread is about security vulnerabilities of which you have demonstrated none.
EDIT OP blocked me for this comment.
1
u/TescoValueSoup 26d ago
There should have been a comma between security and vulns.
Sorry not sorry.
4
u/IWILLGUTYOU 26d ago
Some of these are valid critiques but the other half are written like an intern using a WordPress vulnerability scanner (tips fedora).
2
3
u/ProtoJazz 26d ago
Just to be clear, the supabase project Id as well as the key are always public as far as I know. They live client side and aren't intended to be secret.
If they're doing the usual public key style encryption it's both safe and entirely normal for the key to be public.
All the other stuff, sure. Though none of it sounds all that unusual to me.
I wouldn't worry too much about exposed admin routes if they're properly secured and authenticated. Knowing about them isn't the end of the world, and likely pretty common in apps that have a shared UI instead of a separate admin.
In general any app or service you put your data into is a risk. And more so than the way it's built is who runs it. You need to be able to trust that your data is being used for the reasons they say they collect it for.
3
u/TescoValueSoup 26d ago
I think the bigger thing the exposed admin routes show is he has one for etransfers which he explicitly said he doesn’t store
1
u/ProtoJazz 24d ago
Pretty hard to say one way or another from just the name. Could be all kinds of things, could be nothing at all.
1
u/Big_Ladinio 26d ago edited 26d ago
More interested in the user name.... tin of value soup? Why not asda.... or even Morrisons....
5
1
u/RedBoyRob 25d ago
And thats why i dont goto small shops. If i want something i ask them to find and order. Never had an issue. Never will.
-2
u/StairwayHiker 26d ago
Sounds like someone doesn’t like competition for gun nutz or gun posts.
1
u/LeviathanOfLiberty 26d ago
Someone doesn’t want a fed-compromised site being able to trace a particular NON-RESTRICTED firearm to a PAL holder.
1
u/Clover_Lawn_4440 26d ago
Gun nutz is trash
1
u/EliteDuck 25d ago edited 25d ago
For real. They blacklisted me from listing on the EE solely because I use a VPN. I informed them almost anyone under the age of 30 uses one now, and they're losing business over this policy.
1
u/Mysterious_Sleep7443 25d ago
Why ?
Old Dinosaurs with overpriced garbage?
1
u/Clover_Lawn_4440 25d ago
I joined to sell a bunch of guns I no longer wanted, jumped through their stupid hoops to get EE access and sold 32 guns in 4 months. Thay said I was a business and banned me when I said I was not.
43
u/DoYouGetSarcasm 26d ago edited 26d ago
Now where am i going to get my Canadian firearm sex change if not at CanadianFirearmSexChange.ca ?