Funscript.org post-mortem
Funscript.org which was a service that advertised on Eroscripts is considered a security hazard and we advise you to delete your account and stop using the service. This thread below will serve as a history of the events that took place.
Funscript.org was successful in committing fraud against the forum and disputed the advertising services and paypal sided with them despite the evidence that we did deliver the service.
The last message from funscript.org:
Re: A word regarding the Funscript.org notice (annotated by me)
I understand you’re angry about the PayPal outcome, but I’d genuinely rather resolve this properly than keep trading blows, so I want to lay out where things actually stand.
On the security concern, I think it’s important to separate what happened from how it was presented. What was shown as a “breach” was someone loading the shell of the admin panel through their browser’s developer console. That returns the front-end only: the layout, buttons and labels. No actual data was ever exposed. Every real figure on that panel is served through authenticated, server-side API requests that require proper authorisation; without it, the server returns nothing. (The data was pollable and included real names, and emails. There was no authentication or authorization. You sent the admin username in the headers and it spat out personally identifiable information)
The screenshot being circulated actually demonstrates this. Every statistic on it was scribbled over to make things look worse, but the “Scriptos” balance in the top-right was missed, and it’s showing blank/error precisely because the API refused to return a value to an unauthorised session. In a genuinely authenticated session that field populates normally. They saw the wallpaper, not the house. (It was demonstrated to me that the tokens were irrelevant. They weren’t even needed for the bypass to work.)
For context on how this escalated: the original issue was users uploading scripts they weren’t the creators of. I addressed that immediately, but it snowballed from there. (This was the first issue which was promptly resolved and I was willing to forgive, the gross negligence on security and continued use of AI-only written code from someone who very evidently knew nothing about web dev or security is what rose out of this. The forum now has a very intentional AI code clause in future and current agreements)
Here’s my difficulty. The site-wide notice you published and the “Security Notice” link that still live on your platform, has caused real and ongoing damage: it has driven users to delete accounts, undermined trust in funscript.org, and effectively neutralised the advertising I paid for (This doesn’t make what he did not fraud, the service was delivered and paid for) , since steering people away from the platform makes those impressions worthless.
Because of that, a defamation claim has been raised against your company (I have not been served) for the damage to my business. I’m not telling you that to threaten you, I’m telling you because I’d genuinely prefer not to pursue it. I’m willing to resolve the matter in full if you’ll put things right:
- Post a site-wide notice for 5 days confirming that
funscript.orgis safe and that the earlier warning was based on incomplete/incorrect information.
(I’m not interested in lying to my community) - Remove the “Security Notice” link from your platform.
(I will remove the notice when a report from a verified and reputable security audit comes out clean)
Do those two things and I’ll consider the matter closed and drop the claim and won’t process anymore PayPal disputes (This is blackmail). I think that’s a fair way to draw a line under this for both of us.
Happy to talk it through if you’d prefer.
Ed
