A 16-year-old security researcher named Daniel discovered critical vulnerabilities in Mintlify, an AI documentation platform used by major companies including Discord, X (Twitter), Vercel, and Cursor. He found a cross-site scripting vulnerability that allowed attackers to inject malicious scripts into company documentation and steal user credentials. The attack exploited Mintlify's internal endpoints to serve malicious SVG files with embedded JavaScript across different domains. Working with friends, they responsibly disclosed the vulnerabilities, leading to temporary shutdowns of affected services and earning approximately $11,000 in bug bounties. The incident demonstrates how supply chain attacks can compromise hundreds of companies through a single platform vulnerability.