HARD-CODED API KEY IN AI NOTE TAKING APP EXPOSED USERS' PRIVATE TRANSCRIPTS

Summary from the TLDR InfoSec newsletter

A security researcher from Tenable discovered that a new release of its Mac desktop client included an AssemblyAI API key. This API key could be retrieved from the Electron app to enumerate and download any user's private meeting transcript. The researcher notified Granite, whose CEO responded by removing the offending API key and notifying the researcher that the vulnerability had only affected a smaller group of TestFlight users.