Applebee’s shipped a hardcoded password for its customer database inside its Android app, and anyone who pulled that password out of the app could read the personal records of the chain’s registered customers. TechCrunch reported the flaw on October 30, 2026, after Applebee’s confirmed a day earlier that it had closed the hole. The exposed fields included names, birthdates, phone numbers and the IP addresses of recent logins.
A Researcher Used AI to Find the Hardcoded Password in Applebee’s App
Robert Wiggins, a UK-based security researcher at What Security, found the credential earlier in October by having an AI model search the thousands of lines of source code inside Applebee’s Android app, according to TechCrunch. The app has more than a million downloads on Google Play. The password gave direct access to the company’s customer database, and Wiggins said it could also have let an attacker change customer data. TechCrunch checked the finding independently. Its reporters downloaded and decompiled the app, confirmed the credential was in the code, then registered an Applebee’s account with fake details. Wiggins was able to retrieve that test account from the database.
The Exposed Database Held Birthdates, Veteran Status and Login IP Addresses
The records TechCrunch saw contained customer names, email addresses with a flag showing whether each was verified, dates of birth, phone numbers and ZIP codes. They also held veteran status, the number of times each customer had logged in, account creation dates and the IP addresses of the most recent logins, which can point to a person’s rough location. The total number of exposed customers is unknown. Wiggins did not count the records, because doing so would have meant having the AI model touch potentially every customer’s data. Applebee’s declined to give a figure. TechCrunch noted that the chain’s rewards program had at least 8.5 million members as of last year.
Applebee’s Had No Channel for Reporting Security Flaws
Wiggins could not reach Applebee’s or its parent company, Dine Brands, because neither offered a way to report a security issue, TechCrunch reported. He asked TechCrunch to handle the disclosure, and the outlet held its story until the company confirmed the fix on Thursday, October 29. In an unsigned emailed statement on Friday, a Dine Brands spokesperson said the company “has not currently found any evidence of unauthorized access” and that its investigation continues. The spokesperson would not say whether Dine Brands has server logs it could review, or any logs at all. The company also did not answer how long the password sat in the app, whether it will notify customers or regulators, or whether it will file a disclosure with the Securities and Exchange Commission, which requires public companies to report material cybersecurity incidents.
Why This Matters for Engineering Leadership
A mobile app is a public artifact. Every phone that installs it holds a full copy of whatever the build contains, so a credential compiled into an app belongs to anyone willing to decompile it. Wiggins’s method makes that cost lower still, since an AI model did the reading that once took hours of manual review. The structural fix is that client apps should never hold a credential for a database. They should call a backend API that authenticates each user and enforces what that user can see. Three checks follow for any team that ships mobile or desktop clients. Run a secret scanner against the compiled release artifact as a build gate, alongside the scan of the source repository, because build steps and config files can inject secrets the repository scan never sees. Treat any credential found in a shipped build as compromised and rotate it, because removing it from the next release leaves every installed copy still carrying it. Confirm that the database behind any client-facing service writes access logs you retain, since Dine Brands’ answer about unauthorized access is only as strong as the records behind it. Publish a security contact, such as a security.txt file under RFC 9116, so the next researcher reaches your team before a reporter does.
FAQ
What happened with the Applebee’s app?
Applebee’s Android app contained a hardcoded password for an internal customer database. Anyone who extracted it from the app could read customer records, and the researcher who found it said they could also have changed them.
What customer data did the Applebee’s database expose?
Names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates and the IP addresses of recent logins.
Has Applebee’s fixed the hardcoded password?
Yes. Applebee’s confirmed on Thursday, October 29, 2026 that it had acted to block unauthorized access, and TechCrunch held its story until the fix was confirmed.
Was Applebee’s customer data stolen?
Dine Brands says its investigation has not found evidence of unauthorized access so far. It would not say whether it has server logs that could show who accessed the database.
How many Applebee’s customers were affected?
The number is unknown. Applebee’s would not give a figure, and its rewards program had at least 8.5 million members as of last year.
Why is a hardcoded password in a mobile app dangerous?
Every copy of the app carries the password, so anyone can download the app, decompile it and log in to the backend system as if they were the app.