Applebee's Hardcoded Database Password Exposed Customer Data | Freewares

Here is a security rule so old it has whiskers: never put a password in your app. Anyone can unzip an APK and read what is inside. This week, Applebee's became the latest household name to learn it the public way.

TechCrunch reported on October 30 that a security researcher, working with the help of an AI tool, found the password to an internal database sitting directly in the code of Applebee's Android app, an app with more than a million downloads.

What was exposed

According to the report, the credentials opened a database containing customer names, email addresses, dates of birth, phone numbers, zip codes, and login IP addresses. Worse, the account was not read-only: it could reportedly modify data too.

Applebee's parent company, Dine Brands, fixed the issue after it was disclosed and says it found no evidence of unauthorized access. It did not say how many customers were in the database.

The AI detail worth pausing on

The researcher reportedly used an AI assistant to help comb through the app's code. That is the part that should worry every company shipping a mobile app right now. Digging secrets out of an APK used to take patience and skill. AI tools compress that to an afternoon. Any secret still sitting in shipped code is not hidden; it is just waiting.

The rule, again

Secrets belong on a server, behind an API that checks who is asking. Anything else is a matter of when, not if. And if you build software yourself, scanning your own code for hardcoded credentials takes minutes: free tools like Gitleaks or truffleHog will happily do it before someone less friendly does.

Applebee's got the friendly version this time. Not everyone does.