r/canadaguns • u/TescoValueSoup • 26d ago
Announcement FYI - Canadianfirearmsexchange.ca security vulns and shortcomings, data handling dishonesty and AI usage.
Posting with approval from the Mod team
Post flaired as Misc, couldn't find something else suitable.
I am creating this post so you can make an informed decision before signing up to this website.
Since it was shared on Monday I have been looking in to the canadianfirearmsexchange website and its creator. Original post
I have found in probing the website that not only is it scattershot with poorly implemented or unfinished features, more concerningly I don't believe he has been upfront about how the site has been created or how he's handling and storing user data.
1) His admin routes are discoverable
The client bundle lists routes including:
• /admin/users
• /admin/listings
• /admin/etransfers <----- THIS**
• /admin/contact
• /admin/reports
• /admin/broadcast
• /admin/members/$userId
**He IS collecting users etransfer information, despite saying around the website that "We never collect or store credit card or banking details."
His Supabase project ID is exposed
• Supabase project ID: [removed] - Shown to CanadaGuns mods privately
• Numerous administrative route names and server-function identifiers are exposed too
2) Analytics runs before consent checks. Opt-out doesn't opt-out
The privacy policy says analytics cookies are used “with your consent,” and the banner offers “Essential only.” However, /~flock.js is inserted unconditionally into every page.
It records:
• Full page URL and path
• Referring page
• Browser user-agent
• Preferred language/locale
• A country estimate derived from your timezone
• Timestamp and session ID
• Tracks navigation
• Exposes window.Tinybird.trackEvent(...), allowing the site’s other code to submit custom analytics events.
The site has a second, consent-aware analytics implementation that checks cfe_cookie_consent_v1, but the separate Flock script does not perform that check. Choosing “Essential only” therefore does not to stop all analytics.
Knowingly, or unknowingly he is tracking his users and they can’t opt out of it,.
I wont attribute to malice that which is adequately explained by stupidity, but in this case, both are really bad for a guy claiming to have 30 years of IT experience and raises questions about how experienced the site’s creator actually is.
3) The site lacks any anti-clickjacking protections
The sampled responses did not include either:
• Content-Security-Policy: frame-ancestors none'
• X-Frame-Options
Meaning an attacker could potentially place the site inside an invisible or deceptive iframe and trick a signed-in member into clicking message, listing, or account controls.
4) Finally, and in some ways the most damning of all. The site has been made using Lovable, an AI service.
• The homepage’s Open Graph image contains a Lovable project identifier ending in .lovable.app.
• Image paths use Lovable’s /__l5e/assets-v1/… infrastructure.
• The JavaScript explicitly references:
• window.__lovableEvents
• .lovableproject.com
• .lovable.app
• .lovable.dev
Using Lovable does not itself make the site unsafe. The concern is whether someone competent has reviewed the generated application, backend authorization, privacy model, and operational controls.
I would argue it hasn't been human-reviewed, because of everything I outline above.
People are being asked to submit their real names, providing their location data and addresses (or having it scraped) and a wealth of metadata when they use this.
Not only that, submit an etransfer payment as part of the identification verification process.
And his "geo-protections" are amateurishly done by looking up your IP using IPAPI(dotcom).
For all intents and purposes, barring the actual firearm serial numbers - he is creating alarmingly invasive and private registry of all his users. He is handling their data badly, all while saying he isn't.
TLDR;
This website tracks you even when you opt out.
The site admin is collecting a wealth of information on you, but is saying he isn't (I just cant confirm the extent of the information being collected.)
The site is made with Lovable an AI service, and uses Tinybird(Flock.js), Supabase and a limited application of Cloudflare to handle your data.
This site is a bad actors dream, I would not recommend anyone submit their personal information to it.
-TVS
2
u/ProtoJazz 26d ago
Just to be clear, the supabase project Id as well as the key are always public as far as I know. They live client side and aren't intended to be secret.
If they're doing the usual public key style encryption it's both safe and entirely normal for the key to be public.
All the other stuff, sure. Though none of it sounds all that unusual to me.
I wouldn't worry too much about exposed admin routes if they're properly secured and authenticated. Knowing about them isn't the end of the world, and likely pretty common in apps that have a shared UI instead of a separate admin.
In general any app or service you put your data into is a risk. And more so than the way it's built is who runs it. You need to be able to trust that your data is being used for the reasons they say they collect it for.