Applebee’s shipped the keys to its own customer database inside its app. Security researcher Robert Wiggins of What Security found a password for an internal database buried in the source code of Applebee’s Android app, which has more than a million downloads on Google Play, earlier this month. TechCrunch verified the finding itself: it downloaded and decompiled the app, confirmed the credential was in the code, created a test account, and watched Wiggins retrieve that dummy record from the company’s database.
The database held customer names, email addresses and whether they were verified, dates of birth, phone numbers and ZIP codes, plus veteran status, login counts, account creation dates and the IP addresses of most recent logins, which can reveal approximate location. No payment card fields were listed. TechCrunch describes hardcoded credentials as one of the most severe vulnerability types, because anyone with the app can extract the key and log in to a remote system as an authorised user; the researcher also assessed that the access could have allowed customer data to be changed, not only read.
Dine Brands, Applebee’s parent, confirmed on Thursday that it had acted to close the issue. A spokesperson said on Friday that the security team promptly launched an investigation and has not currently found any evidence of unauthorised access, and that the investigation is ongoing. The company would not say how many customers were affected. Applebee’s had at least 8.5 million rewards members as of last year, which bounds the programme’s scale without establishing an exposure count.
One detail in the disclosure path is its own finding: Wiggins used AI tooling to search thousands of lines of app code for the credential, and, finding no security reporting channel at Applebee’s or Dine Brands, routed the report through a newsroom. The same class of tooling that finds hardcoded secrets in shipped apps is now cheap and widely available, which shortens the life of every credential still sitting in a production binary.