Arrested for what? The system gave them permissions, they didn't exfil data, and they disclosed it to the company. He did those companies a favor by showing them how vulnerable they are by outsourcing every operation and process in pursuit of profits.
No, as company employee is directly tied to and the responsibility of the company.
These companies are responsible for their employees behavior and data but they are not responsible for nor legally liable for (in most cases, some exceptions apply) the actions of a third party that they have retained to help with hiring.
In fact the contract they have with said third party likely absolves them of any liability.
The title should be: I owned an AI startup via Firebase misconfiguration.
You can even name the startup if you want. That’s not flashy though and this person wants marketing.
Of course, but it that’s good in most cases as then you don’t get an overreaction.
The right people will read it (Chattr.ai’s customers) and respond . Right now everyone looks at it and some CISO will overreact and make everyone go check their Firebase configurations which may likely be a non-value add.
Personally I feel the title is justified but I understand and respect your viewpoint.
Also keep in mind that trying to clarify the such would also make the title much longer than I desired.