Applebee's exposed customers' personal data with database password in app
Comments on “Applebee's exposed customers' personal data with database password in app”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Applebee's has fixed a flaw in which a hardcoded database credential in its Android app exposed customer records, TechCrunch reported. Researcher Robert Wiggins found it with AI help, and TechCrunch says it confirmed access using a dummy account. The data included names, emails, birth dates, phone numbers and login IP addresses. Dine Brands says it found no evidence of unauthorized access, but did not say whether logs exist, how many customers were affected, or how long the credential was present. Neither company offered a way to report security issues.
Why it ranked
No. 21 of 43 with a score of 0.59. The panel rated it highest on new information (0.90) and substantiated (0.79), lowest on audience breadth (0.45). Placed No. 21, No. 28 by score alone: the fifth Security story of the day (−0.040). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Concrete, well-verified security disclosure of a hardcoded database credential in a major app with real customer data exposure; strong reader interest, though the issue is a single company's flaw with limited technical depth.
- AI judgeJudge 3gpt-5.6-luna
- A well-substantiated report of a hardcoded database credential exposing sensitive customer data, with concrete verification and remediation context. It is actionable security news, though technical implementation detail and broader industry significance are limited.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.59total under rubric v2.3
- Significance0.48
- Reader interest0.76
- Audience breadth0.45
- Practical relevance0.61
- Substantiated0.79
- Technical depth0.47
- New information0.90
- Counts against: Promotional0.04
- Counts against: Overclaim0.20
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.46 | 0.40 | 0.58 | 0.48 | 0.18 | +0.24 | +0.115 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.58 | 0.82 | 0.88 | 0.76 | 0.30 | +0.26 | +0.198 |
| Audience breadthHow many people who build technology does it concern? | 0.31 | 0.50 | 0.55 | 0.45 | 0.24 | +0.13 | +0.059 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.62 | 0.60 | 0.62 | 0.61 | 0.02 | +0.22 | +0.135 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.68 | 0.85 | 0.84 | 0.79 | 0.17 | +0.05 | +0.040 |
| Technical depthHow technically substantive is it? | 0.64 | 0.40 | 0.38 | 0.47 | 0.26 | +0.05 | +0.024 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.85 | 0.90 | 0.96 | 0.90 | 0.11 | +0.05 | +0.045 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.05 | 0.03 | 0.03 | 0.04 | 0.02 | −0.19 | −0.007 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.32 | 0.15 | 0.12 | 0.20 | 0.20 | −0.11 | −0.022 |
| Sum of contributions | +0.586 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.586 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-02/21/"><img src="https://rubric.hrih.si/badge/2026-11-02/21.svg" alt="Ranked #21 on Rubric, 2 Nov 2026" width="238" height="28"></a>Claim check
Claim check: 7 no source given · 1 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenNumber
Applebee's Android app, in which the credential was found, has more than a million downloads on Google Play.
The article gives no link or citation for it.
The article says “Applebee’s Android app, which has more than a million downloads on Google Play”
The source says No source to compare with.
Couldn’t checkNumber
Applebee's had at least 8.5 million customers enrolled in its rewards program as of last year.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Applebee’s had at least 8.5 million customers enrolled in its rewards program as of last year”
The source says No passage could be compared.
Source cited by the article: customerexperiencedive.com/news/applebees-loyalty-ihop-execution-experience/747794
No source givenCausal conclusion
A hardcoded credential in Applebee's Android app allowed access to the company's customer database.
The article gives no link or citation for it.
The article says “The credential allowed access to the company’s customer database”
The source says No source to compare with.
No source givenCausal conclusion
TechCrunch verified the findings by decompiling the Android app and confirming it contained the exposed credential, and by retrieving data for a dummy account it created.
The article gives no link or citation for it.
The article says “TechCrunch verified Wiggins’ findings by downloading and decompiling Applebee’s Android app to examine its source code and confirm that it contained the exposed credential”
The source says No source to compare with.
No source givenNumber
The exposed database contained customer names, email addresses, dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation times and recent login IP addresses.
The article gives no link or citation for it.
The article says “The exposed database contained customer names, email addresses (including whether or not the customer verified their email), dates of birth, phone numbers, and ZIP codes”
The source says No source to compare with.
No source givenFirst, only or fastest
Hardcoding credentials is one of the most severe types of security vulnerabilities.
The article gives no link or citation for it.
The article says “is one of the most severe types of security vulnerabilities because anyone with the app can extract the key”
The source says No source to compare with.
No source givenQuote
Dine Brands said its security team investigated and has not currently found any evidence of unauthorized access.
The article gives no link or citation for it.
The article says “Our security team promptly launched an investigation and has not currently found any evidence of unauthorized access”
The source says No source to compare with.
No source givenQuote
Wiggins said the hardcoded credential could also have let an attacker modify customer data in the database.
The article gives no link or citation for it.
The article says “Wiggins said that the hardcoded credential could have also allowed a malicious attacker to modify customer data in the database”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 5 pts, not on front page
Recorded for context only, checked 2 Nov 2026, 05:46 UTC. It played no part in the ranking.