Applebee’s quickly patched a critical vulnerability in its mobile app after a security researcher discovered hardcoded credentials allowing open access to customer data, including names, emails, and dates of birth.
- Hardcoded credentials exposed customer PII in Applebee’s app
- More than a million app users potentially affected
- Dine Brands fixed vulnerability with ongoing investigation
What happened
A security researcher named Robert Wiggins employed AI to analyze the source code of Applebee’s Android app and discovered hardcoded credentials embedded within. These credentials provided access to a company database containing sensitive personal information such as customer names, email addresses (both verified and unverified), dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates, and IP addresses from recent logins. With over one million downloads on Google Play, the scale of potential exposure was significant.
Attempts to report this critical flaw directly to Applebee’s or its parent company, Dine Brands, were unsuccessful initially, prompting the researcher to contact TechCrunch. The publication verified the vulnerability by accessing the exposed credentials and confirming the ability to both read and modify database entries. After public confirmation, Dine Brands acknowledged the issue, swiftly closed the security gap, and launched an investigation. As of now, there is no evidence of unauthorized data access.
Why it matters
This incident highlights a prevalent and dangerous security flaw involving hardcoded credentials in software applications. Developers sometimes embed login information during development to speed up testing, but failure to remove these credentials before releasing the app creates an exploitable vulnerability. Attackers scanning source code can use such credentials to gain unauthorized access, potentially resulting in data breaches or system compromises.
Research in 2025 demonstrated that a vast majority of apps leak at least one secret like passwords, API keys, or encryption keys, with many exposing sensitive information that could trigger widespread breaches. High-profile incidents in other tech companies throughout 2025 and 2026 underline the continuing threat posed by such vulnerabilities in both consumer and enterprise software. This case with Applebee’s serves as a stark warning to the industry on strict code review and security hygiene.
What to watch next
Applebee’s ongoing investigation will be critical in determining whether the exposed data was accessed maliciously or leaked in any way. Transparency regarding findings and any steps taken to notify affected customers could shape public trust and regulatory scrutiny. Monitoring other similar restaurant and retail apps for comparable vulnerabilities will also be important in identifying systemic security challenges in consumer-facing mobile applications.
Security teams and developers should reinforce safe coding practices by avoiding any form of hardcoded credentials in production builds and implementing automated scanning tools during release cycles. As cyber threats evolve, app publishers must prioritize proactive vulnerability detection and rapid response to protect user data and maintain brand reputation.