GoKawiilApplebee's fixes app flaw that exposed customer database credentials
Security researcher Robert Wiggins found a hardcoded database password buried in the source code of Applebee's Android app, which has over a million downloads. The credential granted access to a customer database containing names, emails, birth dates, phone numbers, ZIP codes and veteran status. Applebee's confirmed to TechCrunch it has fixed the issue, and TechCrunch verified the flaw before publishing.
GoKawiil's interpretation of the reporting above, not reported fact.
Hardcoding credentials inside an app is considered a severe vulnerability because anyone who extracts the code can log into backend systems as an authorized user, potentially reading or altering customer records. The incident suggests restaurant chains' mobile apps may hold sensitive personal data behind weaker protections than consumers assume, and it underscores how AI-assisted code analysis is making such flaws easier for researchers to uncover.
- A hardcoded database password in Applebee's Android app exposed customer records.
- Exposed data included names, emails, birth dates, phone numbers, ZIP codes and veteran status.
- Applebee's fixed the flaw after being notified, and TechCrunch confirmed the fix before reporting.
Source: techcrunch.com — Zack Whittaker, 2026-10-30
Published there as: “Applebee’s exposed customers’ personal data after leaving database password in app”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.