Applebee’s App Supplied The Database Password. Reporting It Required A Journalist.

Applebee’s fixed a security flaw before TechCrunch reported it on October 30: a password for an internal customer database had been included in its Android app. A researcher found it, but could not find a way to report security problems to Applebee’s or parent company Dine Brands. He asked TechCrunch to help notify the company.

The password travelled inside the app. The warning needed a journalist.

That is a remarkable distribution strategy. The thing that should be difficult to obtain was supplied with the software. The thing you would want a helpful stranger to find—the security-reporting route—became a reporting assignment.

Applebee’s: where discovering the problem apparently came with fewer obstacles than being polite about it.

TechCrunch independently verified the flaw using a dummy account. The exposed information included names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status and account activity. The latest login IP address could also reveal an approximate location. The researcher said the credential could have allowed changes to customer data, too; the report does not establish that a malicious attacker made any.

I was prepared for a restaurant to remember whether I wanted fries. Birth date, veteran status, login history, approximate location: this is a strangely comprehensive dossier for an institution whose principal relationship with me should involve melted cheese.

And if a company collects that much, the responsibility does not remain appetizer-sized. It has ordered the full entrée of maintaining a customer database. No splitting it with the diner when the bill arrives.

Dine Brands says its security team promptly began an investigation and had found no evidence of unauthorized access. It says the investigation is ongoing and it will act on its findings. The flaw was fixed before publication. Good. That is the outcome the researcher and newsroom were trying to achieve.

The company would not tell TechCrunch whether it had server logs available to check access, or any logs at all. That unanswered question does not prove the logs are absent. It does leave the reassurance less inspectable than the app was.

The public explanation should not be the part of the operation with the most successful access restrictions.

The number of people affected is unknown. The researcher declined to run an unnecessary search through potentially every customer record just to produce a bigger, more definite number. There is an encouraging technical development: someone encountered personal information and decided not to collect extra helpings.

The company also did not answer questions about how long the credential had been exposed or whether it would notify customers or regulators. We do not know that a reporting law was violated. We do know that TechCrunch’s questions about the incident generated fewer answers than its test account did.

Restaurants understand the value of making the next step obvious. Order here. Pay here. Pick up here. The entire business depends on somebody noticing a need and being able to convey it without acquiring a professional intermediary.

Yet the route from a serious security discovery to this company ran through a technology newsroom. Investigative journalism: now also a substitute ingredient for the contact information a business forgot to provide.

I support a free press. I had not realised it needed to be listed among Applebee’s essential restaurant supplies, between napkins and whoever knows the password.