FYI - Canadianfirearmsexchange.ca security vulns and shortcomings, data handling dishonesty and AI usage.

[u/TescoValueSoup]

Posting with approval from the Mod team
Post flaired as Misc, couldn't find something else suitable.

I am creating this post so you can make an informed decision before signing up to this website.

Since it was shared on Monday I have been looking in to the canadianfirearmsexchange website and its creator. Original post

I have found in probing the website that not only is it scattershot with poorly implemented or unfinished features, more concerningly I don't believe he has been upfront about how the site has been created or how he's handling and storing user data.

1) His admin routes are discoverable

The client bundle lists routes including:

• /admin/users
• /admin/listings
• /admin/etransfers <----- THIS**
• /admin/contact
• /admin/reports
• /admin/broadcast
• /admin/members/$userId

**He IS collecting users etransfer information, despite saying around the website that "We never collect or store credit card or banking details."

His Supabase project ID is exposed

• Supabase project ID: [removed] - Shown to CanadaGuns mods privately
• Numerous administrative route names and server-function identifiers are exposed too

2) Analytics runs before consent checks. Opt-out doesn't opt-out

The privacy policy says analytics cookies are used “with your consent,” and the banner offers “Essential only.” However, /~flock.js is inserted unconditionally into every page.

It records:

• Full page URL and path
• Referring page
• Browser user-agent
• Preferred language/locale
• A country estimate derived from your timezone
• Timestamp and session ID
• Tracks navigation
• Exposes window.Tinybird.trackEvent(...), allowing the site’s other code to submit custom analytics events.

The site has a second, consent-aware analytics implementation that checks cfe_cookie_consent_v1, but the separate Flock script does not perform that check. Choosing “Essential only” therefore does not to stop all analytics.

Knowingly, or unknowingly he is tracking his users and they can’t opt out of it,.
I wont attribute to malice that which is adequately explained by stupidity, but in this case, both are really bad for a guy claiming to have 30 years of IT experience and raises questions about how experienced the site’s creator actually is.

3) The site lacks any anti-clickjacking protections

The sampled responses did not include either:

• Content-Security-Policy: frame-ancestors none'
• X-Frame-Options

Meaning an attacker could potentially place the site inside an invisible or deceptive iframe and trick a signed-in member into clicking message, listing, or account controls.

4) Finally, and in some ways the most damning of all. The site has been made using Lovable, an AI service.

• The homepage’s Open Graph image contains a Lovable project identifier ending in .lovable.app.
• Image paths use Lovable’s /__l5e/assets-v1/… infrastructure.
• The JavaScript explicitly references:
• window.__lovableEvents
• .lovableproject.com
• .lovable.app
• .lovable.dev

Using Lovable does not itself make the site unsafe. The concern is whether someone competent has reviewed the generated application, backend authorization, privacy model, and operational controls.

I would argue it hasn't been human-reviewed, because of everything I outline above.

People are being asked to submit their real names, providing their location data and addresses (or having it scraped) and a wealth of metadata when they use this.

Not only that, submit an etransfer payment as part of the identification verification process.

And his "geo-protections" are amateurishly done by looking up your IP using IPAPI(dotcom).

For all intents and purposes, barring the actual firearm serial numbers - he is creating alarmingly invasive and private registry of all his users. He is handling their data badly, all while saying he isn't.

TLDR;
This website tracks you even when you opt out.
The site admin is collecting a wealth of information on you, but is saying he isn't (I just cant confirm the extent of the information being collected.)
The site is made with Lovable an AI service, and uses Tinybird(Flock.js), Supabase and a limited application of Cloudflare to handle your data.

This site is a bad actors dream, I would not recommend anyone submit their personal information to it.

-TVS

[u/Sad-Stop-2401]

I am also a kinda sorta may be software guy. So here are some of my reactions to this. Please note, I have not even spent 2 mins looking into this website beyond their privacy policy and likely will NEVER use such site because... well the name of the site is rather .... akward.... CanadianFirearmSexChange. I rather have nothing to do with folks who want to sex change my beloved guns. They are my beauties! Hands off mister!

Jokes apart, I expect a serious operator of such business to spend a little more effort in naming their business.

GunBay.ca

GunXchange.ca

GunSwinger.ca

So many names to choose from!

Anyhoo... on the technical merits.

1. Having a route in bundle is not such a damning evidence unless u/TescoValueSoup discovered something even more sinister hiding behind the route. Just because he has a route does not mean he is collecting payment info. It could be simply a dead route amounting to nothing or could be a etransfer for something totally unrelated. Its not quite the smoking gun that we are looking for. Admin console can allow etransfer for the site services while client payments might be taken care of by a totally different payment processor. (Again, I have not really used the site).
   1. Supabase project ID is designed to be a public id and is not expected to be hidden.
   2. Likewise server function identifiers are not supposed to be hidden.
   3. What is rather needed is that access to such things is gated by strong authentication and authorization mechanism and defended using rate limiting where needed. I have not heard if u/TescoValueSoup has discovered something of that nature. The above two are not evidence of vulnerability IMHO. At worse it shows potential attack surface.
   4. On the same lines, I will be wary about how much a server function exposes. Again I have not seen any of that being claimed. By this I mean if a server function takes a complete query as input (and believe me some implementations that I have seen and generated by AI at time do that!), the function can divulge WAY more than what you will like. Or sometimes the functions expose way more fields of a DB than needed and leaks info that should not be leaked.
2. Yes, collecting analytics is sneaky. Yes, it shows atleast incompetence if not malice. Yes, this is a smoking gun indeed. In his defence, it could just be the platform he built on doing this. Or a mistake of not removing this tracking functionality. It is especially damning when you are trying to build trust. It does show sloppy technical work to say the least.
3. While click jacking is indeed a problem, I will not classify it as acute as it is being described. It means someone can overlay this website with something else and decieve users into clicking some legit controls on this website. There can be structural defense against this (like re-authenticating before any dangerous action instead of relying purely pre-authenticated session). Still in the pantheon of dangers, this is still far fetched. There are bigger dangers like XSS, SQL injection etc that I will be vary of. That being said, putting two headers in your _headers or vercel.json file or whatever you got should not be that hard.
4. I do not think the damning part is that this site was made using loveable. There are certainly better tools for the task (ClaudeCode + your own Github CICD pipeline to deploy on say ... netlify? come to mind). Also, I do not think using AI for code generation is a damning thing in 2026. Heck a simple query in ClaudeCode or a simple skill can actually be a great starting point for auditing your web app. Provided you know what you are doing. This and using supabase are not the worst sins, though I would not have used them. The damning part is elsewhere.
5. The BIGGEST damning part is he does not disclose where he is storing your private data that is exposed to his website! https://canadianfirearmsexchange.ca/privacy . For someone dealing in firearms, it is necessary to tell its users where their data is being stored? As in which country, which company. It helps people to make an informed decision if they should use your platform or not. I think but not certain it is also a requirement of PIPEDA and BC PIPA. I will be upfront about where I am storing my visitor what data and who accesses it and who processes it. I will tell them I am using supabase and their backend as a service can store and process my data say in US. Or for instance, I will not like someone's name etc to be stored or accessible in a country that can be hostile to them. This software supply chain risk IMHO is bigger than all of the above for firearms owners. Especially because the community and hobby attracts people with diverse political opinion and they are judged for their opinions in the light of their ownership of firearms. I will like to know for instance if they use Zohomail (I do not know what email service or mailer they use) to process email communication, with Zohomail having potential data storage and/or administration done in India because it is headquartered in India.

[u/ChaoticDNA → u/Sad-Stop-2401]

Let's be serious - unless the data is stored at a sovereign data center, your data is at risk.