A security researcher found a hardcoded password sitting inside Applebee’s Android app that could have let anyone pull up names, birthdates, phone numbers, and login history for millions of the chain’s rewards members.
TL;DR: Robert Wiggins, a UK-based researcher at What Security, used AI tools to dig through thousands of lines of code in Applebee’s Android app and found a credential for an internal customer database baked directly into the software. TechCrunch verified the flaw by decompiling the app and pulling real account data before reporting it. Applebee’s parent company, Dine Brands, says it fixed the issue and hasn’t found evidence of unauthorized access, though it won’t say how long the password had been exposed or how many customers were affected.
How a password ends up baked into an app
Hardcoding credentials means a developer writes a username and password directly into the app’s source code instead of pulling it from a secure, separate system at runtime. It’s a shortcut that’s been a known no-no in software security for about as long as mobile apps have existed, and it keeps showing up anyway because it’s genuinely the fastest way to get something working during development. The problem is that anyone who downloads the app can decompile it and read that code, which is exactly what Wiggins and later TechCrunch’s own reporters did. Applebee’s Android app has more than a million downloads on Google Play, which gives you a sense of how many copies of that password were sitting out in the wild.
What was actually exposed
Once Wiggins had the credential, he could log into the customer database directly. The data available included full names, email addresses and whether each one had been verified, dates of birth, phone numbers, ZIP codes, and whether a customer had identified as a veteran. The database also tracked login counts, account creation dates, and the IP addresses tied to each customer’s most recent logins, which can be used to approximate where someone was when they last opened the app.
To confirm the bug was real and not theoretical, TechCrunch’s reporters created a brand-new Applebee’s account using fake information, and Wiggins successfully pulled that dummy data straight out of the database using the exposed credential. That’s about as clean a proof of concept as a disclosure like this gets.
Nobody could tell them how to report it
One of the more frustrating details here is procedural rather than technical. Wiggins had no way to directly contact Applebee’s or Dine Brands about the vulnerability, because neither company has a published channel for reporting security issues. That’s not unusual for a restaurant chain, which typically doesn’t think of itself as needing a bug bounty program the way a software company would, but it meant Wiggins had to go through TechCrunch to get the issue in front of anyone who could actually fix it. TechCrunch says it held the story until Dine Brands confirmed the fix was in place.
A Dine Brands spokesperson said the company’s security team “promptly launched an investigation and has not currently found any evidence of unauthorized access,” adding that “our investigation is ongoing.”
When asked directly whether it has the server logs needed to actually check for past unauthorized access, the spokesperson declined to answer. That’s a meaningful gap, since “we haven’t found evidence” means something very different depending on whether you were actually able to look.
Why AI made this bug easier to find, not harder
There’s an irony worth sitting with here. Wiggins used AI tools to help him search through thousands of lines of decompiled code faster than a human reviewer could manage alone, which is exactly the kind of use case security researchers have been excited about for the past couple of years. The same technology that companies worry could be misused by attackers also made it dramatically easier for a legitimate researcher to find a real, serious flaw before anyone malicious apparently did. It’s a reminder that AI-assisted code review cuts in more than one direction, and companies shipping apps with any kind of hardcoded secret should probably assume someone, researcher or otherwise, now has an easier time finding it than they did two years ago.
How many people does this actually touch
Nobody involved has put a hard number on the affected customers, including Applebee’s. Wiggins noted that counting them precisely would require running an AI model against what could be essentially every customer record in the database, which he didn’t do. For scale, Applebee’s rewards program reportedly had at least 8.5 million enrolled members as of last year, and a flaw in the central customer database would, in theory, touch all of them, though there’s no confirmation the credential was actually misused by anyone before it was found.
What’s still unanswered
TechCrunch asked Dine Brands whether it plans to notify affected customers or regulators, including whether this rises to the level of a disclosure under SEC cybersecurity rules that require public companies to report material incidents. The company hasn’t answered that question, and it also wouldn’t say how long the credential had been sitting in the app before Wiggins found it in October. Those two answers matter more than almost anything else here, since a credential that’s been live for years is a very different story than one that slipped in with a recent update. It’s a familiar shape of failure too, not far off from the stolen connection keys behind the UpdraftPlus backdoor affecting millions of WordPress sites or the planted SSH credentials in the fake Claude Code extension discovered last week. Hardcoded secrets keep being the thing that gets everyone caught.
The bottom line
A hardcoded database password is one of the most basic security mistakes a company can make, and it landed inside an app with over a million downloads from a brand people trust with their names, birthdates, and phone numbers for the sake of free appetizers. Dine Brands fixed the immediate hole, but “no evidence of unauthorized access” isn’t the same as “we checked and nobody got in,” and until the company says whether it has the logs to tell the difference, customers are left taking that distinction on faith.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
