Reverse engineering a $1B Legal AI tool exposed 100k+ confidential files

Who Should Read

Security engineers and backend devs building SaaS products with third-party OAuth integrations, and CTOs evaluating legal AI vendors.

Core Mechanics

• Filevine had a publicly accessible API endpoint that returned Box admin tokens without any authentication — a classic insecure direct object reference issue on a privileged token endpoint.
• The exposed tokens gave access to Box admin accounts belonging to law firm customers, meaning confidential legal documents (over 100K files) were readable by anyone who hit the endpoint.
• The researcher reported the vulnerability responsibly, but initial response from Filevine was slow. The issue was eventually patched.
• This is a textbook OAuth token storage failure: the server-side tokens were returned client-side with no authorization check on the caller.
• The attack surface is especially sensitive here — legal SaaS products hold privileged client communications, case files, and court documents that carry attorney-client privilege.

Evidence

• The researcher documented the endpoint, sample request, and sanitized token response, confirming the unauthenticated access was trivially reproducible.
• Community reaction was strong: several commenters noted this is a systemic problem with 'move fast' SaaS culture when applied to high-sensitivity legal data.
• Others pointed out that law firms face ABA ethics rules around client data confidentiality — a breach like this could expose firms to bar complaints in addition to legal liability.
• There was debate about whether Filevine's response timeline was acceptable for a security incident of this severity.

How to Apply

• Audit all endpoints that return OAuth tokens or third-party API credentials — verify that caller authorization is checked, not just authentication.
• Never store third-party admin tokens in a way that's retrievable via a user-facing API without checking the requester's permission scope.
• For legal/medical/financial SaaS: treat third-party integration tokens as secrets with the same access controls you'd apply to raw credentials.
• Add automated tests for your most sensitive API endpoints that explicitly verify unauthenticated requests are rejected with 401/403.

Code Example

// Vulnerable pattern: frontend directly receives a high-privilege token and calls external API
const res = await fetch(`${BOX_SERVICE}/recommend`, {
  method: 'POST',
  body: JSON.stringify({ projectName: 'Very sensitive Project' })
  // No Authorization header!
});
const { boxToken } = await res.json(); // admin token is returned as-is

// Safe pattern: backend acts as proxy or issues short-lived presigned URLs
// Backend (Node.js example)
app.get('/api/file/:fileId', authenticate, async (req, res) => {
  // 1. Verify user permissions
  const hasAccess = await checkPermission(req.user, req.params.fileId);
  if (!hasAccess) return res.status(403).json({ error: 'Forbidden' });
  
  // 2. Call Box API using a token stored only on the backend
  const boxClient = new BoxClient({ accessToken: process.env.BOX_ADMIN_TOKEN });
  const downloadUrl = await boxClient.files.getDownloadURL(req.params.fileId);
  
  // 3. Return only a short-lived URL (no direct token exposure)
  res.json({ url: downloadUrl, expiresIn: 60 });
});

Terminology

Related Resources

• https://alexschapiro.com/security/vulnerability/2025/12/02/filevine-api-100k
• https://news.ycombinator.com/item?id=42301433
• https://www.filevine.com/news/filevine-proves-industry-leade
• https://developer.box.com/reference/