Show HN: US Routing – Python library for fast local routing in the US (github.com)

91 points by ivanbelenky 11h ago 22 comments

Show HN: eInk optimized manga with Kindle Comic Converter (+Kobo/ReMarkable) (github.com)

219 points by seam_carver 19h ago 44 comments

Show HN: Ductape – Build back end integrations once, reuse them anywhere (ductape.app)

24 points by Ifedayo_s 3d ago 7 comments

Show HN: Clippy – 90s UI for local LLMs (felixrieseberg.github.io)

1082 points by felixrieseberg 1d ago 261 comments

Show HN: Create feature-rich aliases for the CLI in YAML (github.com)

3 points by furrball010 5h ago 1 comments

Show HN: Plexe – ML Models from a Prompt (github.com)

124 points by vaibhavdubey97 1d ago 45 comments

Show HN: Whippy Term - GUI terminal for embedded development (Linux and Windows) (whippyterm.com)

93 points by SurvivorTed 1d ago 12 comments

Show HN: Sheet Music in Smart Glasses

199 points by kevinlinxc 1d ago 24 comments

Show HN: VectorVFS, your filesystem as a vector database (vectorvfs.readthedocs.io)

269 points by perone 2d ago 138 comments

Show HN: iOS App Size Analysis Tool for macOS (apps.apple.com)

2 points by elpakal 8h ago 0 comments

Show HN: Feedsmith — Fast parser & generator for RSS, Atom, OPML feed namespaces (github.com)

68 points by macieklamberski 1d ago 9 comments

Show HN: TextQuery – Query CSV, JSON, XLSX Files with SQL (textquery.app)

159 points by shubhamjain 2d ago 57 comments

Show HN: A CLI tool for interacting with Linear (github.com)

2 points by Beefin 9h ago 1 comments

Show HN: Picostrap5 A free bootstrap-based WordPress theme on GitHub (github.com)

6 points by giovapanasiti 14h ago 0 comments

Show HN: My AI Native Resume (ai.jakegaylor.com)

296 points by jhgaylor 3d ago 194 comments

Show HN: Reverse Pac-Man (reverse-pacman.staticrun.app)

71 points by Eagle64 2d ago 47 comments

Show HN: Launching cloud-instances.info, a new fork of ec2instances.info (leanercloud.beehiiv.com)

2 points by alien_ 10h ago 3 comments

Show HN: Klavis AI – Open-source MCP integration for AI applications (github.com)

78 points by wirehack 2d ago 50 comments

Show HN: Tkintergalactic - Declarative Tcl/Tk UI Library for Python (github.com)

86 points by leontrolski 2d ago 10 comments

Show HN: Real-time AI Voice Chat at ~500ms Latency (github.com)

509 points by koljab 2d ago 225 comments

Show HN: Bracket – selfhosted tournament system (github.com)

151 points by tripleseven 2d ago 35 comments

Show HN: ESP32 Autoswitcher for Bad Campus WiFi (aydendiel.dev)

3 points by otherayden 12h ago 0 comments

Show HN: I built a 7-day calendar app – no months or years, just the next 7 days (weeklong.life)

45 points by nbagersh 2d ago 32 comments

Show HN: Free, in-browser PDF editor (breezepdf.com)

779 points by philjohnson 4d ago 172 comments

Show HN: Driverless print server for legacy printers, profit goes to open-source (printserver.ink)

184 points by ValdikSS 3d ago 38 comments

Show HN: Outpost – OSS infra for outbound webhooks and event destinations (github.com)

65 points by alexbouchard 1d ago 8 comments

Show HN: I vibe-coded Product Hunt, but for Videos (tubehunt.co)

3 points by westche2222 14h ago 0 comments

Show HN: Journelly for iOS: like tweeting but for your eyes only (in plain text) (xenodium.com)

80 points by xenodium 3d ago 63 comments

Show HN: YouTube Time Machine – browser extension to find forgotten videos (frankmeeuwsen.com)

9 points by thatinternetguy 1d ago 0 comments

Show HN: Cloi – free local debugging agent in your terminal (github.com)

7 points by mingyk 17h ago 1 comments

Show HN: I crammed my daily tools into a single iPhone keyboard (apps.apple.com)

2 points by abdullahajmal 18h ago 0 comments

Show HN: PageQL – Embed SQL directly in HTML (pageql.dev)

13 points by xiphias2 1d ago 7 comments

Show HN: Free web "Form Builder" (TypeForm for free) (forms.labs.crafxdesign.com)

9 points by ssdesign 1d ago 0 comments

Show HN: I taught AI to commentate Pong in real time (github.com)

204 points by pncnmnp 5d ago 52 comments

Show HN: CodeCafé – A real-time collaborative code editor in the browser (github.com)

78 points by mrktsm__ 3d ago 11 comments

Show HN: LocoStudio - A better UI for Ollama (locostudio.ai)

5 points by simmy345 22h ago 0 comments

Show HN: Nelly – Create your own team of AI agents (nelly.is)

7 points by gitmagic 22h ago 0 comments

Show HN: Agents.erl (AI Agents in Erlang) (github.com)

4 points by arthurcolle 1d ago 1 comments

Show HN: Use Third Party LLM API in JetBrains AI Assistant (github.com)

102 points by Stream 4d ago 40 comments

Show HN: I built a synthesizer based on 3D physics (anukari.com)

510 points by humbledrone 5d ago 123 comments

Show HN: ProcASM – A general purpose, visual programming lanugage (procasm.temware.site)

10 points by Temdog007 3d ago 5 comments

Show HN: Wordle style games are not dead. I collected 314 and looking for more (dles.gg)

7 points by trizoza 1d ago 1 comments

Show HN: OSle – A 510 bytes OS in x86 assembly (github.com)

159 points by shikaan 6d ago 32 comments

Show HN: Tired of bloated time trackers? Here's a dead-simple, free one I built (apps.apple.com)

16 points by vikmex 2d ago 5 comments

Show HN: OpenRouter Model Price Comparison (compare-openrouter-models.pages.dev)

8 points by pacific01 2d ago 4 comments

Show HN: Roons – Mechanical Computer Kit (whomtech.com)

203 points by uncial 6d ago 30 comments

Show HN: Kubetail – Real-time log search for Kubernetes (github.com)

126 points by andres 6d ago 35 comments

Show HN: GPT-2 implemented using graphics shaders (github.com)

226 points by nathan-barry 5d ago 25 comments

Show HN: Pipask – safer pip without compromising convenience (github.com)

52 points by Feynmanix 4d ago 38 comments

Show HN: Hyperparam: OSS tools for exploring datasets locally in the browser (hyperparam.app)

76 points by platypii 6d ago 21 comments

Exploiting Copilot AI for SharePoint

2 ocdtrekkie 3 5/7/2025, 12:40:36 PM pentestpartners.com ↗

Comments (3)

p_ing · 21h ago

This isn't all that interesting. There's no exploit as we hope to know it, but rather it's just glorified search via another means. And indeed, Copilot is simply using Microsoft Search (which federates with SPO Search) to find the content to return. Audit logs still exist!

The article author also fails to identify that one of the more effective ways of combating this is Sensitivity Labels (yeah, another subscription, but big companies don't care). But correctly states that permission hygiene is the most effective way to do this.

> when files and images are shared on Microsoft Teams, SharePoint automatically creates a site for them.

And no, that's not how it works. A Microsoft Team already has an SPO site. When a file is uploaded to a Team, it is actually uploaded to SPO. In a 1:1 or 1:Many chat outside of a Team, it is uploaded to the sender's OneDrive account.

ocdtrekkie · 21h ago

I think there's a huge difference in that convincing LLMs to go outside their rules is a very well-driven field already. So if that LLM can access the sensitive data, we can't assume an LLM will ever successfully avoid giving it to someone who does not have the correct label.

p_ing · 19h ago

But that's not what is being presented, here. This post just presents a simple permission misconfiguration or not using the correct tools for the data with the given system (Sensitivity Labels on M365).

If there was a breakout of Copilot in M365 to produce data you lacked permission to, that would be a worthy blog post (hopefully after the bug bounty was processed).