Applebee's forced to fix serious security issue which exposed customer data

Applebee's has resolved a security flaw in its mobile app that inadvertently exposed customer data, including names, contact details, birthdays, and account metadata. While no evidence of abuse has been found, the incident underscores the ongoing risk of hardcoded secrets in software. Applebee's Android app, which enables customers to browse menus, customize orders, place delivery or pickup orders, save favorites, and receive personalized food recommendations, contained this vulnerability.

Using AI to analyze the app's source code, security researcher Robert Wiggins discovered hardcoded credentials for a company database. This database held a wealth of sensitive information, such as customer names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates, and the IP address of the most recent login session.

The app, which has over a million downloads on Google Play, may have exposed data for many users. However, Wiggins found no way to report the issue to Applebee's or its parent company, Dine Brands, so he contacted TechCrunch. TechCrunch confirmed the exposure by finding the exposed credentials and even created a new entry that Wiggins could extract, further confirming the vulnerability.

Dine Brands acknowledged the issue, stating they appreciated TechCrunch and the security researcher for bringing it to their attention, and confirmed their security team had launched an investigation with no evidence of unauthorized access. The company also promised to take appropriate steps based on their findings. Hardcoded credentials, often used for convenience during development, pose a significant risk if not removed before app launch.

In March 2025, Cybernews found over 815,000 hardcoded secrets in more than 156,000 iOS apps, with 71% of apps leaking at least one secret. This issue is not isolated to Applebee's, as Cisco and Dell have also faced similar problems with hardcoded credentials in their software, leading to potential breaches and data leaks.