Tell HN: Fiverr left customer files public and searchable

In a digital economy where freelancers and clients exchange sensitive documents daily, trust hinges on privacy. Yet, a startling oversight at Fiverr—a leading global marketplace for freelance services—has exposed thousands of private client files to the open web. These aren’t just generic project drafts or design mockups; they include tax returns, financial statements, legal documents, and other materials laden with personally identifiable information (PII). The breach didn’t stem from a sophisticated cyberattack, but from a fundamental misconfiguration in how Fiverr handles file storage and access—specifically, its use of public URLs instead of secure, time-limited links.

At the heart of this issue is Cloudinary, a cloud-based media management platform widely used by developers to process and deliver images, videos, and PDFs. Fiverr relies on Cloudinary to handle file uploads within its messaging system, where freelancers send completed work to clients. While Cloudinary supports secure, signed URLs that expire after a set time—effectively acting like a digital vault with a time-locked door—Fiverr chose to use public, permanent URLs. This means once a file is uploaded, anyone with the link can access it indefinitely, and worse, search engines like Google can index it.

The consequences are already visible. A simple search for `site:fiverr-res.cloudinary.com form 1040` returns dozens of IRS tax forms, complete with names, Social Security numbers, and financial data. These documents were never meant for public consumption, yet they’re freely accessible to anyone with basic search skills. Even more alarming, Fiverr has been running Google Ads targeting phrases like “form 1234 filing,” effectively drawing attention to keywords that could lead users—and search engines—directly to these exposed files. This creates a paradox: the company is advertising services that, when delivered, result in regulatory violations due to inadequate data protection.

This isn’t just a privacy faux pas—it’s a systemic failure with legal and ethical ramifications. Under the Gramm-Leach-Bliley Act (GLBA) and the FTC’s Safeguards Rule, financial institutions and service providers handling consumer financial data must implement reasonable security measures. While Fiverr isn’t a bank, it facilitates transactions involving financial professionals—accountants, tax preparers, bookkeepers—who are legally bound to protect client data. By failing to secure these files, Fiverr may have inadvertently enabled its freelancers to violate federal regulations, exposing both workers and clients to potential liability.

The Anatomy of a Preventable Breach

To understand how such a critical flaw could persist, it’s important to examine the technical infrastructure behind Fiverr’s file-sharing system. Cloudinary is a powerful tool used by companies ranging from startups to Fortune 500 firms. It offers features like image transformation, format conversion, and—crucially—access control through signed URLs. These URLs include cryptographic signatures and expiration timestamps, ensuring that only authorized users can view a file, and only for a limited time.

Fiverr, however, opted for public URLs—essentially permanent, unauthenticated links. This approach is simpler from a development standpoint but introduces significant risk. Unlike signed URLs, public links can be shared, guessed, or discovered through search engine indexing. Once a PDF containing a tax return is uploaded and assigned a public URL, it becomes a static web resource, no different from a blog post or news article. If that URL contains predictable patterns or is linked from a public page, search engines will crawl and index it.

The problem is compounded by Fiverr’s apparent lack of robots.txt restrictions or noindex meta tags on Cloudinary-hosted content. These are standard web tools that tell search engines not to index certain pages. Without them, Google’s crawlers treat every file as fair game. As a result, hundreds of sensitive documents have appeared in search results, some even ranking for highly specific queries.

This isn’t the first time a major platform has mishandled Cloudinary configurations. In 2021, a similar issue affected a popular e-learning platform, exposing student assignments and exam answers. The root cause was identical: public URLs used for private content. These incidents highlight a broader trend—companies often prioritize convenience over security when integrating third-party services, especially when those services abstract away the underlying complexity.

The Human Cost of Exposed Data

Behind every exposed tax form or financial document is a real person whose privacy has been compromised. Consider a freelance accountant who uses Fiverr to prepare a client’s tax return. The client uploads W-2s, 1099s, and bank statements—documents that contain not just names and Social Security numbers, but also income details, investment records, and even health savings account information. When the accountant sends the completed Form 1040 via Fiverr’s messaging system, that file is stored on Cloudinary with a public URL.

Now imagine that URL being indexed by Google. A curious neighbor, a data broker, or even a malicious actor could stumble upon it. The client has no idea their financial life is publicly accessible. They trusted Fiverr and the freelancer to keep their information safe. Instead, their data is floating in the open web, vulnerable to identity theft, phishing, or sale on the dark web.

The freelancer, too, bears risk. Many Fiverr workers are independent contractors who may not have the legal resources to defend themselves if a client sues over a data breach. Under the GLBA, financial professionals are required to safeguard client information. If a tax preparer on Fiverr unknowingly transmits a return via an insecure channel, they could be found non-compliant—even if the platform, not the worker, is at fault.

This creates a troubling power imbalance. Freelancers rely on platforms like Fiverr for income, but they have little control over how the platform handles their work. They can’t configure Cloudinary settings or enforce encryption. They’re left vulnerable to the platform’s security decisions, which in this case, appear to have prioritized speed and cost over safety.

The Failure of Responsible Disclosure

When security researchers discover a vulnerability, the standard practice is responsible disclosure: notifying the company privately and giving them time to fix the issue before going public. In this case, the researcher followed protocol, sending a detailed report to Fiverr’s security team at [email protected]. But after 40 days—a period typically considered more than sufficient for acknowledgment—there was no response.

This silence is telling. It suggests either that Fiverr’s security team is under-resourced, unresponsive, or unwilling to acknowledge the problem. In the cybersecurity community, a lack of response to a legitimate disclosure is often interpreted as indifference or denial. When companies ignore such reports, they not only endanger their users but also erode trust in the broader ecosystem of digital labor platforms.

The researcher ultimately decided to go public, not to shame Fiverr, but to protect users. They noted that the issue doesn’t qualify for a CVE (Common Vulnerabilities and Exposures) designation because it’s not a software flaw per se, but a configuration error. It also doesn’t fit neatly into CERT (Computer Emergency Response Team) reporting frameworks, which typically handle active exploits rather than systemic misconfigurations.

This gray area in cybersecurity governance leaves many platform-level risks unaddressed. While individual developers can be held accountable for writing insecure code, companies often escape scrutiny for architectural decisions that compromise user data. The Fiverr case underscores the need for clearer standards around platform responsibility—especially in gig economy services where users have little recourse.

The Irony of Targeted Advertising

Perhaps the most baffling aspect of this saga is Fiverr’s use of Google Ads to promote services that, when delivered, result in exposed data. The company runs ads for keywords like “form 1234 filing” and “tax preparation help,” drawing users to its platform. But once those users hire a freelancer and exchange documents, those files become publicly accessible.

This creates a perverse incentive: the more Fiverr advertises financial services, the more sensitive data it inadvertently exposes. It’s as if a bank advertised “secure vaults” while leaving the doors unlocked. The ads not only attract clients but also increase the volume of data flowing through an insecure pipeline.

Moreover, search engines like Google use ad keywords to refine their indexing algorithms. When Fiverr bids on terms like “tax return help,” it signals to Google that these topics are relevant and valuable. This can indirectly encourage deeper crawling of related content—including the very files that should remain private.

The situation raises ethical questions about corporate accountability. Should platforms be allowed to profit from services that inherently risk user privacy? Should advertising networks like Google take responsibility for promoting services that lead to data exposure? These are complex issues, but they point to a larger truth: in the digital age, privacy is not just a technical concern—it’s a business and ethical one.

Lessons for the Gig Economy

The Fiverr incident serves as a cautionary tale for the entire gig economy. Platforms like Upwork, TaskRabbit, and Freelancer.com connect millions of workers with clients, often involving the exchange of sensitive information. Yet, many of these platforms treat data security as an afterthought, focusing instead on user experience, speed, and scalability.

To prevent future incidents, platforms must adopt a security-first mindset. This includes using signed URLs for file sharing, implementing strict access controls, and regularly auditing third-party integrations. They should also provide transparency to users about how their data is stored and protected.

Freelancers, too, must be vigilant. Using encrypted email, secure file-sharing tools, or even offline delivery for sensitive documents can reduce risk. Clients should ask freelancers about their data handling practices before sharing personal information.

Ultimately, trust is the currency of the gig economy. When platforms fail to protect that trust, they don’t just risk lawsuits or fines—they risk losing the very users who sustain their business. Fiverr’s oversight may have been technical, but its impact is deeply human. In an era where data is as valuable as money, privacy isn’t a feature—it’s a fundamental right.

This article was curated from Tell HN: Fiverr left customer files public and searchable via Hacker News (Top)