I have a bit of a habit of checking out any website that looks interesting, just to see how it’s doing and what it’s ranking for. It’s not something I do for any particular reason, I just find it interesting. Most of the time nothing comes of it, but a while back it ended up landing me a decent sized project, so I thought it was worth writing up.
I came across the site on Reddit. It was an AI product, and I’d been using it for a little while and was pretty impressed with it. As always though, I ended up having a bit of a deeper look at things, and spotted a fairly big issue.
What I found
A lot of the conversations people were having with the AI were being saved to their own URLs, and those URLs were indexed in Google. I initially spotted a few of them ranking for long-tail terms in SEO tools, then ran a quick site: query on the directory to see just how many there were.
There were a lot.
Some of them were fairly harmless, but plenty weren’t. A quick site: search for a phrase like "my address is" turned up someone’s full home address. Others had people’s names, dates of birth and email addresses in them, and there was a fair amount of stuff that people obviously wouldn’t want attached to their name in a search result. One of them was a complete s*x tourism itinerary that the user had mapped out with AI, which also had their PII in. I’m sure there was more, but that was just from a quick look.
To be clear, nothing had been hacked or leaked. The pages were just indexable, and nobody had really thought about it. From an SEO point of view it’s also a lot of bloat and potentially a crawl budget issue on a site that size (Google have a decent doc on that), but honestly the privacy side of it was the bigger concern.
The email
I emailed them. It was two lines to a general address, and this is the whole thing:
I was using the site and noticed a major technical/privacy related issue. I was wondering who was best to talk to about this.
They replied within a minute and asked to hear more.
The second email was a bit longer, but it’s worth explaining what was in it, because it’s basically the opposite of a sales email. I said it might be something they were already aware of, but I thought I’d flag it anyway. I explained what was indexed, with a few examples. I said it could well be intentional, and that I could see why you might want user-generated content indexed, as it has the potential to drive a lot of traffic. Then I explained why I thought it was a problem regardless, and said I was happy to give some advice on fixing it if they wanted it.
There was no proposal or pricing in it.
Within a couple of hours they’d started deleting the pages. They asked how I’d found them, so I told them exactly how (including the search operators). Then this, in their reply:
Your timing is great as we were evaluating SEO partners as we speak … but you just moved to the top of my list.
What happened next
I’ll be honest, timing did a lot of the work here. They just happened to be looking for someone that week. If I’d sent the same email a month earlier I’d probably have got a thank you and that would have been that (I’d still have sent it though..!).
We had a call the next day. They’d already had an audit done by another agency and asked what I thought of it. I said it was OK, which it was, but it spent a lot of time on things that have a pretty small ranking impact and missed a couple of much bigger issues. It’s a bit awkward telling someone that about a document they’ve paid for, but there’s not much point in being vague about it either.
They then asked me for a price. They’d been quoted everything from $4/hr to $1,000/hr and had no idea what was reasonable, which I can understand, because both of those are nuts. I don’t charge by the hour anyway, so I scoped it out as a project and gave them a fixed price. It came to over £5k in the end, and a bit more after some follow-on work.
They said let’s do it, and the contract was signed and paid the same evening.
The takeaway
I’d be a bit careful with the takeaway here, as “find a bug, email the company, get paid” isn’t really a business development strategy. I’ve flagged things to plenty of companies over the years and heard nothing back, which is fine, as that’s not really why I do it.
The habit is the main thing. I look at sites because I find it interesting, and I did it for years before it ever led to anything. Occasionally it turns up something worth telling someone about, and every now and then that turns into work.
The other thing is not attaching anything to it. If that first email had included my rates it would’ve looked like a sales pitch (or worse), and I’m pretty sure it’d have gone straight in the bin. It worked because there was nothing in it for me when I sent it.
If you go looking
One thing worth saying, as this involved people’s personal information. If you find something like this, tell the company quietly, give them time to fix it, and don’t post the examples anywhere.
Most of the time you won’t find anything, but occasionally you’ll find something the company really needs to know about.