Tea App That Claimed to Protect Women Exposes 72,000 IDs in Epic Security Fail

Key Points

1. Tea's unsecured backend database led to a leak of 59.3 GB of data, including 13,000+ verification selfies and government IDs, as well as tens of thousands of images from messages and posts.

2. The app, which had recently gone viral with over 4 million users, required government ID and selfie uploads for verification, claiming compliance with law enforcement for cyber-bullying investigations.

3. The breach was caused by 'vibe coding,' where developers used AI tools like ChatGPT to generate code without proper authentication, leaving the Firebase bucket publicly accessible.

4. Researchers found that 48% of AI-generated code contains exploitable flaws, yet 25% of Y Combinator startups use AI for their backend development, raising concerns about security risks.

5. The incident highlights broader issues with AI-generated code security, including 'slopsquatting,' where hackers exploit non-existent packages suggested by AI, leading to vulnerabilities.