Security bugs engulf ShipFast, a popular indie hacker's product, in drama

Being one of the biggest names in the space, Marc Lou is always one of the most discussed indie hackers on the X timeline. He’s frequently praised… and frequently criticized. 

Now he's at the center of an explosive controversy that has drawn the entire indie hacking community into a debate over product quality, security practices, and the ethics of public bug reporting.

And it all began with a tweet from a fellow indie hacker.

Simon finds a bug

On October 18th, an indie hacker that goes by Simon quote-tweeted a post praising ShipFast’s affiliate program:

The tweet went super viral, pulling in four million views, and it was a precursor for the debates to come. There were people defending the merits of boilerplates and those who took the opposite position.

But Simon wasn't done. Later that day, he posted about an error with ShipFast’s server side validation:

With 11 million views, this tweet went even more viral then the first. As you’d expect, the discussion was much more lively than before, with many indie hackers feeling like Simon violated the unwritten rules around bug reporting.

Here’s John Rush with an accurate representation of the prevailing sentiment:

However, Simon didn’t feel he'd done anything wrong.

And he wasn't alone in that belief:

Marc, meanwhile, seemed completely unamused:

Little did he know that Simon was just getting started.

And another one, and another one…

On October 19th, Simon tweeted that he'd found a new Marc Lou-related bug.

This time it was a serious security vulnerability with IndiePage, and because of its seriousness, he sent him a DM instead of posting it publicly.

Later that day, he put ShipFast on serious blast:

He then criticized Marc’s use of SVGs instead of an icon library and how he was able to get ShipFast for free.

This seemed to spur a community security audit, as other people also began to find serious security vulnerabilities:

According to Simon, the reason for his crusade was simple: ShipFast is $200 and is used by a lot of people, so it deserves the highest level of security. So, if Marc isn’t going to respond privately, he has no choice but to post publicly. 

Justified or not, this got Marc’s attention, and not in a good way:

Unfortunately for Marc, it also got the attention of the rest of indie hacker X.

The boilerplate debate

After Simon’s numerous finds, many of the people who'd previously supported Marc Lou began to turn against him, with the consensus being that his response had been too dismissive considering the seriousness of the issues:

This then became a debate over what a boilerplate should be:

And how a boilerplate should be marketed:

Even Pieter Levels chimed in:

What does this mean for the future of indie hacking?

With this tweet, Marc put an end to this saga:

But the debates spurred on by the drama are sure to stay:

• What should be expected from a boilerplate?

• What is the correct way to report a bug?

• And, as Dagobert puts it, is the indie hacking community becoming toxic?

It’ll be interesting to see how these questions are answered in the coming months and years.