The connection between your domain and the domain you say you're not connected to is just a coincidence, right?
Domain: carebridgehealthinitiative.org
Registered On: 2025-12-18 Expires On: 2026-12-18 Updated On: 2025-12-23 Status: client transfer prohibited Name Servers: ns1.dns-parking.com ns2.dns-parking.com Registrar Information Registrar: HOSTINGER operations, UAB
Domain: littlestepsfoundation.org
Registered On: 2024-08-23 Expires On: 2026-08-23 Updated On: 2025-08-05 Status: client transfer prohibited Name Servers: ns1.dns-parking.com ns2.dns-parking.com Registrar Information Registrar: HOSTINGER operations, UAB
The connection between your domain and the domain you say you're not connected to is just a coincidence, right?
Domain:
carebridgehealthinitiative.org
Registered On:
2025-12-18
Expires On:
2026-12-18
Updated On:
2025-12-23
Status:
client transfer prohibited
Name Servers:
ns1.dns-parking.com
ns2.dns-parking.com
Registrar Information
Registrar:
HOSTINGER operations, UAB
Domain:
littlestepsfoundation.org
Registered On:
2024-08-23
Expires On:
2026-08-23
Updated On:
2025-08-05
Status:
client transfer prohibited
Name Servers:
ns1.dns-parking.com
ns2.dns-parking.com
Registrar Information
Registrar:
HOSTINGER operations, UAB
You are not a registered nonprofit. Look yourselves up, you cannot, because you are not listed: https://apps.irs.gov/
Your donations page lists a Pakistani bank, and you do not provide an American EIN, yet you claim to be based in New Mexico. Who is your registered agent? Calling yourselves a nonprofit when you are not actually a nonprofit is not a good start.
This appears to be a legitimacy issue, not a Stripe software issue.
What is upsetting about it exactly? Did people hate the wheel when it was invented because it took away jobs carrying loads instead of wheeling them? One person can wheel a lot, I'm sure that upset a bunch of won't-adapt non-wheelers.
The only thing you need to land a software engineering job is to be a pro at Data Structures and Algorithms. You don't even need to code any projects, as long as you can distill an obscure two-page word problem from the top of your head into code within 45 minutes, you are good to go. In my experience, nothing else matters to employers.
Have you tried running this against itself? I found critical security vulnerabilities:
1. Command Injection Risk (CRITICAL)
The web application passes user-controlled input directly to subprocess commands without proper sanitization. An attacker could inject malicious commands through the target_url, wordpress_path, llm_endpoint, or tests parameters. app.py:232-264
2. No Authentication (CRITICAL)
All API endpoints are completely unauthenticated. Anyone can start security scans against arbitrary URLs, potentially using your server to attack others. app.py:481-516
3. Server-Side Request Forgery (HIGH)
Users can provide any URL as the scan target, allowing attackers to scan internal networks, localhost services, or use your server as a proxy for attacks. app.py:484-493
4. No CSRF Protection (HIGH)
POST endpoints lack CSRF token validation, making them vulnerable to cross-site request forgery attacks. app.py:481-482 app.py:567-568
5. No Rate Limiting (MEDIUM)
Endpoints lack rate limiting, allowing abuse and denial-of-service attacks.
Email from OpenAI: Transparency is important to us, so we want to inform you about a recent security incident at Mixpanel, a data analytics provider that OpenAI used for web analytics on the frontend interface for our API product (platform.openai.com). The incident occurred within Mixpanel’s systems and involved limited analytics data related to your API account.
This was not a breach of OpenAI’s systems. No chat, API requests, API usage data, passwords, credentials, API keys, payment details, or government IDs were compromised or exposed.
What happened
On November 9, 2025, Mixpanel became aware of an attacker that gained unauthorized access to part of their systems and exported a dataset containing limited customer identifiable information and analytics information. Mixpanel notified OpenAI that they were investigating, and on November 25, 2025, they shared the affected dataset with us.
What this means for you
User profile information associated with use of platform.openai.com may have been included in data exported from Mixpanel. The information that may have been affected was limited to:
Name that was provided to us on the API account
Email address associated with the API account
Approximate coarse location based on API user browser (city, state, country)
Operating system and browser used to access the API account
Referring websites
Organization or User IDs associated with the API account
I asked our overlord GPT, and it says that people who use “ROTFLOL” are typically at least in their early 40s or older, since “ROTFLOL” originally comes from Usenet in the 90s and actual 12-year-olds use new acronyms and avoid old ones like “ROTFLOL.” So I was mistaken, and you are just an adult making childish comments on Hacker News to people you disagree with. Congrats.