A login screen is not a lock

The dashboard had a login page. It just didn't matter.

What was reported. On October 16, MyBroadband reported that an internal web dashboard used by Bootlegger, a South African coffee franchise, sent a large amount of data down with its login page. The data sat in the page source, readable by anyone who had the URL, without signing in. MyBroadband says it verified that this included names and contact information linked to 132 Bootlegger locations, plus some performance and financial data. The app was hosted on Railway and was taken down after MyBroadband asked the company for comment.

How the URL got out. According to the anonymous person who disclosed it on the MyBroadband forums and Reddit, Bootlegger employees posted photos of their laptop screens on Instagram, the site was visible in those photos, and somebody looked it up.

What Bootlegger says. In a statement to MyBroadband, CEO Ricky Ruthenberg said the company learned of the issue on the afternoon of Thursday, October 15, and took the platform fully offline the same day. He said it was a legacy version of BOS, an internal operations dashboard that had already been migrated to a secure environment, but whose historical data had not been fully decommissioned. He confirmed that certain information "was not protected by its login": business performance data, café pipeline information, Google listing details, and the names and emails of franchisees and operators and the names and mobile numbers of general managers. He said no customer data was on the platform, there is no evidence so far that core systems were accessed, and Bootlegger will notify South Africa's Information Regulator under POPIA.

Why people are calling it vibe-coded. MyBroadband reported that the CEO "appears to have encouraged or directly developed" the dashboard using Claude. In a July 1 LinkedIn post quoted by MyBroadband, he wrote about weeks of vibe-coding, said he had mandated Claude for his 15 direct reports, and said "software itself will soon become free, I am almost certain." Neither MyBroadband nor Bootlegger has said exactly which tool wrote this specific code, and we don't claim it either.

Our take

The sloppy part is not that an AI wrote the code. It is that nobody looked at what the page sent before anyone logged in.

This is one of the oldest mistakes in web software: the screen asks for a password, but the server has already handed over the data. AI tools make it easier to ship that mistake, because a login form that looks right is exactly what a prompt asks for. Access control is not something you can see in a demo.

And "legacy" is not a defense. An old deploy with real data on a public URL is a live system. Software may be getting cheaper to write. Leaked phone numbers are not getting cheaper to clean up.

The five-minute check

• Open your app signed out, in a private window. View the page source and the Network tab in your browser's developer tools. If you can see names, emails or figures before logging in, so can everyone else.
• Search the page for a real record. Pick one customer email or store name you know is in your data and search the source and the loaded JavaScript for it.
• Check the server, not the screen. Every request that returns data should check who is asking. Call your data endpoints without a session; they should return nothing.
• List every deploy you have. Preview, staging and "old" copies on Railway, Vercel, Netlify or anywhere else. Delete the ones you don't use, and the data with them.

What we did and didn't do: MODEL did not access the dashboard, which was offline before we looked, and we did not test any of the tools involved. Everything above comes from MyBroadband's reporting and Bootlegger's statement to it, linked below.

MODEL Editors