Hardcoded database password in Applebee's Android app exposed customer records

What happened

Applebee's has fixed a security flaw that allowed anyone to access the personal information of its registered customers, after a researcher discovered a password for an internal database hidden inside the chain's Android app, according to TechCrunch.

U.K.-based security researcher Robert Wiggins of What Security found the credential earlier in October. TechCrunch reports that he used an AI model to comb through the app's source code and surface the secret, which granted access to the company's customer database. The app has been downloaded more than a million times on Google Play.

Embedding a password or key directly in shipped software, known as hardcoding, is considered among the most serious classes of security flaws, because anyone who obtains the app can pull out the credential and log in to the remote system as though they were an authorized user.

TechCrunch says it independently verified the finding by decompiling the app itself and confirming the credential was present. Its reporters then created an Applebee's account filled with dummy data, which Wiggins was able to retrieve from the company's database.

What data was exposed

The database contained names, email addresses and whether they had been verified, dates of birth, phone numbers and ZIP codes. It also stored veteran status, login counts, account creation dates and the IP addresses of customers' most recent logins, data that can be used to approximate a person's location. Wiggins said the credential could have let a malicious attacker modify customer records, not just read them.

It is unclear how many customers were affected. According to TechCrunch, counting the records would have required querying the database and potentially touching every entry, which Wiggins avoided. Applebee's rewards program counted at least 8.5 million members as of last year, but the company would not say how many of them were exposed by the flaw.

A disclosure gap

Wiggins reportedly had no direct way to warn Applebee's or its parent company, Dine Brands, because neither provides a channel for reporting security issues. He turned to TechCrunch for help with coordinated disclosure, and the publication held the story until the bug was confirmed fixed.

A Dine Brands spokesperson said the security team promptly opened an investigation and has not found evidence of unauthorized access so far. When asked by TechCrunch, the spokesperson would not confirm whether the company keeps server logs that could reveal who accessed the database, or whether it keeps logs at all. The company did not respond to questions about how long the credential had been in the app, whether customers or U.S. regulators would be notified, or whether it would file a disclosure with the Securities and Exchange Commission, which publicly traded companies must submit for material cybersecurity incidents.

Why it matters

For developers, this is a textbook lesson in secret management. Mobile apps are public artifacts: they are distributed to anyone, and compiled binaries can be decompiled with free tooling. Any credential baked into an app must be treated as compromised the moment it ships, and TechCrunch's verification makes the point plainly, since a reporter with no inside knowledge could extract the password and query live customer data.

The mitigations are well understood: keep secrets server-side, have apps authenticate per-user against an API that enforces authorization, rotate anything that has shipped in a binary, and run secret scanning in CI and binary analysis before release. None of this is exotic; it just has to actually happen.

The story also shows the cost of having no security contact. A researcher with a serious, confirmed finding had to route it through a newsroom. A published vulnerability disclosure policy and a simple intake channel would have given the company quiet lead time instead of a journalist-brokered disclosure and an unanswered question about whether access logs even exist.