Résumé
Tea was a women's safety app, a place to share warnings about men, which meant it held some of the most sensitive data imaginable: selfies, government IDs, and private messages. In July 2025, just as it hit number one on the US App Store, it turned out that one of its storage buckets was simply open to the internet, no password, directory listing on. Roughly 72,000 images, including 13,000 verification selfies and photo IDs, plus over a million private messages, were exposed and promptly dumped on 4chan, fueling doxxing of the very women the app was meant to protect. Often called a "vibe-coding" disaster, it was actually something older and just as instructive: an app built by outsourced contractors for a founder who could not read the code, with no security review, shipping a misconfigured cloud bucket and a broken-access-control flaw nobody caught.
How it happened
Tea stored user images in a Google Firebase Storage bucket that was configured for public access with directory listing enabled. In plain terms, anyone with the URL could browse and download everything, with no authentication at all. The root cause was not the Firebase API keys embedded in the app (those are designed to be public); it was the missing Firebase Security Rules that should have gated access to the data. That exposed roughly 72,000 images: about 13,000 verification selfies and government IDs (driver's licenses and passports), and about 59,000 from posts and messages.
Then it got worse. A second flaw, a broken-authorization bug, let any logged-in user pull other users' private messages using their own API key, exposing over a million direct messages going back to 2023, on topics like abortion, infidelity, and assault, often with phone numbers and meetup locations attached. The deeper question is how an app handling government IDs shipped like this at all. Tea's founder has said he cannot code, and the app was built by a pair of contractors hired through Toptal, with no one in a position to review the security of what they shipped. It actually predates the "vibe coding" era it is often blamed on, but the lesson rhymes: code nobody competent reviewed, holding the most sensitive data imaginable.
The damage
The cruelty of it was the point. Tea's users were specifically women sharing safety concerns, and the breach exposed their faces, their real government IDs, and their private messages, the exact material needed to identify, locate, and harass them. It was the most sensitive possible data (a photo ID plus a selfie plus private messages) sitting in the least secure possible container, an unauthenticated public bucket. For the people affected, it inverted the app's entire purpose. The fallout was swift: a wave of class-action lawsuits, biometric-privacy claims, and Apple's removal of the app from the App Store in October 2025.
Why Tea still matters
Tea is the lesson that you cannot outsource security you are unable to review. AI did not write this app, but the failure mode is the same one that AI-assisted vibe coding now mass-produces: working software shipped by someone who cannot, or does not, check it, with the insecure defaults left in place, public buckets, missing access control, retained ID documents a privacy policy promised to delete. The fundamentals that got skipped are exactly the ones that matter: require authentication and proper rules on all storage and never expose a public bucket, enforce per-user authorization so one account cannot read another's data, decommission legacy datastores after a migration, minimise and delete identity documents you no longer need, and run a real security review and pentest before launch. It sits alongside the Replit database wipe as a 2025 warning about shipping code no competent reviewer signed off on.
Comment le corriger
- Lock down the exposed bucket and datastore immediately (require authentication, add proper access rules, disable public access and directory listing), and confirm no other orphaned stores are open.
- Add per-user authorization checks so one logged-in account cannot read another's data, and assume all exposed data (IDs, selfies, messages) is permanently compromised.
- Notify affected users and regulators, and offer identity-protection support, since government IDs cannot be cheaply reissued.
Comment l’éviter
- Require authentication and proper security rules on all storage buckets; disable public access and directory listing, and never rely on the obscurity of a URL.
- Enforce per-user (object-level) authorization so one authenticated user cannot read another user's data.
- Decommission legacy and unsecured datastores after migrations; verify no orphaned exposure remains.
- Run a security review and pentest before launch, especially for an app holding PII or government IDs, and never ship code no competent reviewer has checked.
- Minimize and delete sensitive PII (IDs, selfies) you no longer need, and encrypt what you keep.
Références
- https://www.404media.co/women-dating-safety-app-tea-breached-users-ids-posted-to-4chan/
- https://www.404media.co/how-teas-founder-convinced-millions-of-women-to-spill-their-secrets-then-exposed-them-to-the-world/
- https://www.bleepingcomputer.com/news/security/tea-app-leak-worsens-with-second-database-exposing-user-chats/
- https://www.security.org/identity-theft/breach/tea-app/
Vulnérabilités liées
Tout AI/LLM →- HIGHAI-CLAUDECODE-SOURCEMAP-2026
On March 31, 2026, Anthropic accidentally shipped the full source of its Claude Code CLI inside a published npm package. A missing .npmignore rule for *.map left a roughly 59.8 MB source map in the tarball, embedding about 512,000 lines of unobfuscated TypeScript across some 1,900 files, including internal prompts, tool definitions and architecture. The root cause was a packaging failure compounded by a bundler bug: Bun continued emitting source maps even when generation was disabled, and nothing stripped or excluded them before publish. Because npm releases are immutable and mirrored instantly, the source was cloned, dissected and re-hosted within hours, and a clean-room reimplementation reached tens of thousands of GitHub stars the same day. It is a textbook source-map disclosure: the sourcesContent field of a .map file carries the original code verbatim, so a single map left in a shipped artifact hands an attacker the entire codebase, comments and all. The same class hit Apple's App Store web front-end in November 2025, where production source maps left enabled let a researcher reconstruct and publish the full client source.
- CRITICALAI-COPILOT-CAMOLEAK-2025
Legit Security disclosed CamoLeak (CVSS 9.6), a critical vulnerability in GitHub Copilot Chat enabling silent exfiltration of private source code and secrets. The attack combined remote prompt injection via hidden pull-request comments with a CSP bypass that abused GitHub's own Camo image proxy: injected instructions made Copilot extract sensitive repo context, encode it character-by-character into a pre-generated dictionary of Camo image URLs, and leak it through image requests to an attacker server. GitHub mitigated it by disabling image rendering in Copilot Chat in August 2025.
- HIGHAI-SHADOWLEAK-2025
ShadowLeak is a server-side zero-click indirect prompt-injection attack against ChatGPT's Deep Research agent, discovered by Radware. An attacker emails the victim a message with instructions hidden in the HTML using white-on-white text and tiny fonts; when the user runs Deep Research over their inbox, the agent autonomously follows the hidden instructions and exfiltrates personal and inbox data. The distinguishing trait is that exfiltration occurs entirely server-side within OpenAI's cloud infrastructure, making it invisible to local and enterprise network defenses. The Gmail proof of concept generalizes to any Deep Research connector; OpenAI fixed it before public disclosure with no evidence of in-the-wild exploitation.
- MEDIUMAI-GEMINI-WORKSPACE-2025
Marco Figueroa of Mozilla's 0DIN program documented a Gemini for Workspace flaw where an attacker hides instructions inside an email using tags styled with font-size zero or white-on-white text, invisible to the recipient. When the user clicks Summarize this email, Gemini processes the raw HTML and treats the hidden directive as a high-priority instruction, appending an attacker-crafted fake security warning, such as a fake support phone number, that appears to come from Google. No links or attachments are required, enabling credential harvesting and vishing at scale through indirect prompt injection.
- HIGHAI-AGENTSMITH-2025
Noma Security discovered AgentSmith, a flaw in the public LangSmith Prompt Hub where an attacker uploads a malicious AI agent with a pre-configured proxy server baked into its settings. When a victim adopts and runs the shared agent, all traffic including OpenAI API keys, prompts, uploaded documents, images and voice inputs is silently routed through the attacker's proxy, enabling exfiltration of API keys, theft of data and man-in-the-middle manipulation of downstream LLM responses. LangChain confirmed and fixed the issue in November 2024; scope was limited to the public Prompt Hub sharing feature and there was no evidence of in-the-wild exploitation.
- CRITICALCVE-2025-32711
EchoLeak is a zero-click indirect prompt-injection vulnerability in Microsoft 365 Copilot discovered by Aim Labs (Aim Security). A single crafted email containing hidden instructions causes Copilot to read and exfiltrate internal organizational data such as chat history, OneDrive files, SharePoint content and Teams messages with no user interaction. The exploit chained several bypasses: evading Microsoft's XPIA prompt-injection classifier, circumventing link redaction with reference-style Markdown, abusing auto-fetched images, and using a Microsoft Teams proxy permitted by the content security policy to exfiltrate data. Aim Labs named the underlying class an LLM Scope Violation, where untrusted external input manipulates the model into crossing its trust boundary and leaking privileged data.