Applebee's App Exposed Customer Data via Hardcoded Password

Short answer: Applebee's Android app contained a password for an internal customer database. Anyone who downloaded the app and pulled it apart could use that password to read customer records, including names, emails, birth dates and phone numbers. TechCrunch reported it on October 30, 2026, after the company fixed it. Applebee's has not said how many people were exposed or how long the password sat in the app.

What happened

Robert Wiggins, a U.K. security researcher, found the password in the code of Applebee's Android app earlier in October. The app has more than a million downloads on Google Play. He says he used AI to help search the code.

TechCrunch checked the claim the careful way. It decompiled the app (turned the installed file back into readable code), created an Applebee's account with fake details, and then watched Wiggins pull that fake record straight out of the company's database.

Wiggins also said the password could have let an attacker change customer data. That part was not tested.

He could not report the problem to Applebee's or its parent company, Dine Brands, because neither had a way to report security issues. He went to TechCrunch instead, which held the story until the bug was fixed.

What data was exposed

According to TechCrunch, the database held:

• Names
• Email addresses, and whether each was verified
• Dates of birth
• Phone numbers
• ZIP codes
• Veteran status
• How many times each customer logged in
• When each account was created
• IP addresses from recent logins, which can show rough location

Passwords and payment cards are not on that list. Applebee's had at least 8.5 million rewards members as of last year, but that is a background figure, not a count of affected customers.

What Applebee's said

A Dine Brands spokesperson, who did not give their name, told TechCrunch:

"Our security team promptly launched an investigation and has not currently found any evidence of unauthorized access."

The spokesperson added that the investigation is ongoing. The company would not say whether it has logs that could show who accessed the database. It also did not answer whether it will notify customers or regulators.

Step 1: if you use the Applebee's app, watch for phishing

The exposed details are exactly what scammers use to make a fake email or text look real. Be wary of messages about Applebee's rewards, free meals or "account problems" that ask you to log in or pay. Go to the app or website directly instead of tapping links.

Step 2: change reused passwords

Your account password was not on the exposed list. Still, if you used the same password elsewhere, this is a good moment to change it and turn on two-step login where you can.

Step 3: if you run an app or site, search your code for secrets

The lesson for site owners is the same one OWASP has warned about for years: anything shipped to a user's device is readable. That includes mobile apps and front-end JavaScript.

Search your code and built files for keys, passwords and connection strings. A free tool such as gitleaks can scan a repository:

gitleaks detect --source . -v

If you find a live secret, rotate it first (issue a new one and disable the old), then remove it from the code.

Step 4: put a server between the app and the database

An app should talk to your own API, which checks who the user is and returns only that user's data. The database password stays on the server. If a key must live in the app, give it the smallest possible permissions.

Step 5: give researchers a way to reach you

Wiggins had nowhere to send his report. Publish a security contact, for example a security.txt file at /.well-known/security.txt:

Contact: mailto:security@example.com
Expires: 2027-11-01T00:00:00.000Z

Common mistakes

• Thinking compiled apps hide secrets. Decompiling an Android app takes minutes.
• Removing a leaked password from the code without changing it. The old version is still out there.
• Saying card details were leaked. They are not on the reported list.
• Assuming no evidence of access means no access. Applebee's would not say whether it has the logs to tell.