Prodigy, a commercial scriptable annotation tool by Explosion AI used to label training data for machine learning and NLP models, was detected. Its local web server (default port 8080, built on uvicorn/FastAPI) ships with no built-in authentication or user accounts by default and is designed to run on localhost or a trusted network. The annotation UI was found directly reachable to unauthenticated visitors.
Log in to view the POC file snapshot cached by Shenlong Bot
Log in to view