Applebee’s left database key in app

Applebee’s says it has fixed a security flaw that left registered customers’ personal information reachable through its Android app, after a researcher found a database password embedded in the app’s code.

The finding matters because this is one of the bluntest avoidable errors in software security. A hardcoded credential is, in effect, a key shipped with the product. If the app can be downloaded, the key can be extracted. TechCrunch reported that it decompiled the Android app, confirmed the credential was present, and created a test account whose information the researcher was then able to pull from the company’s database.

According to TechCrunch, the exposed records included customer names, email addresses, dates of birth, phone numbers and ZIP codes. The database also showed whether an email address had been verified, how many times a customer had logged in, when an account was created, veteran status, and the IP address from the most recent login. An IP address is not a street address, but it can still help place a person roughly in space.

Dine Brands, Applebee’s parent company, said in a statement that its security team investigated after being alerted and had not found evidence of unauthorized access. That is not the same thing as proving no one got in. TechCrunch said the company would not say whether it has server logs that could show who accessed the database, if anyone did.

What is established is narrow but serious: the credential was in the app, it allowed access to the customer database, and the company says the issue has been addressed. What remains unknown is how long the credential was exposed, how many people’s data sat behind it, whether anyone besides the researcher accessed the database, and whether customers or regulators will be formally notified.

The researcher, Robert Wiggins, told TechCrunch he was unable to report the flaw directly because neither Applebee’s nor Dine Brands appeared to offer a security contact or vulnerability disclosure channel. That administrative detail can sound minor until it is not. A company can fix a bug faster if people know where to send the warning.

Applebee’s had at least 8.5 million rewards members as of the prior year, TechCrunch reported, but the company did not provide a figure for how many customer records were exposed by this flaw.