Millions of diners use restaurant apps to earn rewards and skip the line. A TechCrunch exclusive shows why developers need to be careful about what’s tucked inside that code. Applebee’s has fixed a flaw that let anyone with its mobile app reach customers’ personal information.
Quick Facts
- Company: Applebee’s, owned by Dine Brands
- The flaw: A hardcoded database credential inside the Android app
- Status: Fixed, according to the company
- Found by: U.K. security researcher Robert Wiggins of What Security
- Source: TechCrunch exclusive (reporter Zack Whittaker, October 30, 2026)
What Went Wrong
Wiggins found a password for Applebee’s customer database tucked inside thousands of lines of source code in the company’s Android app, which has more than a million downloads on Google Play. He used AI to help locate it.
Developers call this “hardcoding credentials,” and security experts rank it among the most severe mistakes. Anyone who downloads the app can pull the key out and log in to the remote system as an authorized user. Wiggins said an attacker could have changed customer data, not just read it.
TechCrunch verified the finding by examining the app’s code and creating a dummy account. Wiggins was then able to retrieve that test information from the database.
What Data Was Exposed
According to TechCrunch, the database held:
- Customer names
- Email addresses, plus whether each was verified
- Dates of birth
- Phone numbers
- ZIP codes
- Veteran status
- Login counts and account creation dates
- IP addresses from recent logins, which can reveal approximate location
How Many People Are Affected?
Nobody knows yet. Wiggins said counting customers would have meant accessing potentially every record, which he avoided. For scale, Applebee’s had at least 8.5 million rewards members as of last year, per a trade report cited by TechCrunch. The company wouldn’t say how many people were exposed.
Why the Disclosure Was Tricky
Wiggins couldn’t alert the company directly, because neither Applebee’s nor Dine Brands offers a way to report security issues. He asked TechCrunch to help. TechCrunch held its story until the flaw was confirmed fixed.
What Applebee’s Says
A Dine Brands spokesperson said the security team launched an investigation and hasn’t found any evidence of unauthorized access so far. The company wouldn’t say whether it keeps server logs that could show if anyone else got in, and it didn’t answer questions about how long the credential had been exposed or whether it will notify customers or regulators, including the SEC.
What Customers Should Do
Nothing in the report says people’s passwords leaked, but exposed personal details can feed scams. General precautions:
- Be wary of unexpected emails or texts that mention Applebee’s or your rewards account.
- Use a unique password for your Applebee’s login.
- Watch for phishing that uses your name, birth date or phone number.
- Enable account alerts if the app offers them.
- Wait for official notices from Applebee’s before clicking links.
The Bigger Lesson for App Makers
Secrets stored inside an app are never really secret. Companies should keep database credentials on secure servers, publish a clear vulnerability disclosure channel and keep logs that help them investigate. The Applebee’s case shows what happens when a researcher with good intentions has nowhere to send a warning.
What to Watch Next
- Whether Applebee’s discloses the number of affected customers
- Any breach notifications to users or regulators
- Whether the company adds a security reporting channel
- Findings from Dine Brands’ ongoing investigation
Source: TechCrunch