{
  "docId": "019dd923-622c-750b-8b97-2bce5eee365a",
  "docSlug": "68ffcc59f6e4",
  "documentTitle": "Lemonade, Inc. (LMND)",
  "authorId": "51_Muddy_Waters",
  "authorName": "Carson Block",
  "documentKindSlug": "shareholder-letter",
  "documentKindLabel": "Shareholder letter",
  "sourceTypeSlug": "short_seller",
  "sourceTypeLabel": "Short seller",
  "presentationDate": "2021-05-13 00:00:00",
  "orientation": "portrait",
  "aspectRatio": 0.77272725,
  "pageNumber": 3,
  "pageCount": 10,
  "prevPage": 2,
  "nextPage": 4,
  "slideType": "expose_contradiction",
  "function": "expose_contradiction",
  "density": "dense",
  "nDataPoints": 0,
  "notes": "This is a page from a short-seller report (Muddy Waters) attacking Lemonade's security posture.",
  "elementsJson": [
    "bullet_list",
    "paragraph"
  ],
  "metadataConfidence": 0.9,
  "imagePath": null,
  "slideHref": "/slides/019dd923-622c-750b-8b97-2bce5eee365a/3",
  "deckHref": "/decks/019dd923-622c-750b-8b97-2bce5eee365a",
  "deckJsonHref": "/decks/019dd923-622c-750b-8b97-2bce5eee365a.json",
  "deckAnchorHref": "/decks/019dd923-622c-750b-8b97-2bce5eee365a#slide-3",
  "components": [
    {
      "bbox": null,
      "kind": "callout",
      "text": "We call upon Lemonade to take its site offline immediately and fix the vulnerability.",
      "attrs": null,
      "subkind": null,
      "toolName": "Visual emphasis",
      "toolSlug": "visual-emphasis",
      "confidence": null,
      "componentId": "019dd953-0935-737e-8dc4-139f64500d78",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.05,
        "w": 0.54,
        "x": 0.23,
        "y": 0.165
      },
      "kind": "list",
      "text": "If the front door is this wide open, then how well secured are Lemonade's back doors, including its API? Lemonade's perceived value lies in part in its data collection - how well-secured is this proprietary advantage?",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "10c77696-9a07-4403-bc0f-1cfb8dc6f3eb",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.03,
        "w": 0.58,
        "x": 0.21,
        "y": 0.275
      },
      "kind": "paragraph",
      "text": "We call upon Lemonade to take its site offline immediately and fix the vulnerability.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "219c1be2-1904-4416-a381-1400b0eae175",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.25,
        "w": 0.58,
        "x": 0.21,
        "y": 0.365
      },
      "kind": "paragraph",
      "text": "We expect that in an attempt to deflect from Lemonade's negligence, it will emphasize that Muddy Waters did not follow the practice of coordinated disclosure...",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "43a05f56-bfe2-4288-b707-00e17f184e9b",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.05,
        "w": 0.58,
        "x": 0.21,
        "y": 0.665
      },
      "kind": "paragraph",
      "text": "We found a Stored Session Fixation Vulnerability in Lemonade's insurance quoting system. We believe that a vulnerability such as this would typically receive a Common Vulnerability Scoring System (CVSS) score of 10, indicating a critical security risk.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "4ffca2c8-b0b4-49c6-b072-07b0b312d866",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.02,
        "w": 0.15,
        "x": 0.21,
        "y": 0.337
      },
      "kind": "title",
      "text": "Coordinated Disclosure",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "004f2949-09d4-4fca-85de-0f94b2edd057",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.02,
        "w": 0.45,
        "x": 0.21,
        "y": 0.645
      },
      "kind": "title",
      "text": "Lemonade.com Security Vulnerability: Scope, Impact, and Remediation",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "829025f3-278d-47ad-998a-c21729beaf39",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [
    {
      "name": "fraud-exposure",
      "slug": null,
      "matchId": "5a113aea-59fd-48da-b049-82fe3284ebb7",
      "evidence": "The slide explicitly attempts to expose a security failure to damage the company's reputation and stock value.",
      "confidence": 0.9
    }
  ],
  "arcBeats": [
    {
      "to": 4,
      "from": 3,
      "beatId": "643e463f-b2de-48f1-ab9b-1cd839dacd1e",
      "arcName": "Overcoming the Monster",
      "arcSlug": "overcoming-monster",
      "beatName": "The Monster (Problem)",
      "beatSlug": "overcoming-monster-the-monster",
      "evidence": "Description of the Lemonade.com Vulnerability",
      "position": 0,
      "confidence": 0.8,
      "parentBeatName": "Hook",
      "parentBeatSlug": "hook"
    }
  ],
  "loops": [
    {
      "to": 5,
      "from": 3,
      "name": "The Reveal",
      "slug": "05-the-reveal",
      "bestFor": "Product launches, strategic pivots, unexpected findings",
      "matchId": "130e79d4-df07-4e5c-ae3e-b30d424d1029",
      "evidence": "The document reveals the vulnerability and provides steps to reproduce",
      "position": 0,
      "objective": "Reveal the vulnerability and coordinated disclosure",
      "structure": "Setup the Question -> Build Suspense -> The Big Reveal",
      "confidence": 0.7,
      "description": "Build mystery and anticipation, then deliver a surprising or powerful conclusion"
    }
  ],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}