Applebee's Android App Hardcoded Password: What to Know

Applebee's Android app shipped with a password for an internal customer database, and anyone who extracted it could read the personal information of registered customers. Applebee's confirmed on October 29, 2026 that it has fixed the flaw, which a UK-based researcher found earlier that month.

The researcher, Robert Wiggins of What Security, used AI tools to search the app's code and located the credential. It opened access to a database holding names, email addresses, email verification status, dates of birth, phone numbers, ZIP codes, veteran status, account creation dates, login counts and IP addresses from the most recent logins. Payment card details and account passwords were not among the exposed fields, according to the company's account of the incident.

How a password ends up in a shipped app

A hardcoded credential is a secret written directly into code or configuration. Once the app is published, anyone can download the package and decompile it, so the secret travels with every install. The Applebee's Android app has more than 1 million downloads on Google Play, which made the password available to any user willing to dig through the package.

In this case, AI tools did the search that would otherwise require dedicated reverse-engineering work. That lowers the skill needed to find secrets in consumer apps, and it makes an old mistake easier to exploit at scale.

What Dine Brands says about the exposure

Dine Brands says it has found no evidence of unauthorized access so far, and its investigation is ongoing. The company has not published a count of affected customers, and the exact number is not known. The disclosure therefore leaves two questions open: whether anyone used the credential before the fix, and how many accounts were visible.

Applebee's Android app: a checklist for customers

Customers who had the app should treat the exposed fields as material for phishing. Names, email addresses, phone numbers and birthdays are enough to write a convincing message that appears to come from the restaurant chain. Useful checks include:

Ignore texts or emails about rewards, refunds or account changes, and open the official app directly instead of following links.
Change the password on the Applebee's account and on any other service where the same password is used.
Treat callers who cite your birthday, ZIP code or veteran status as unverified, even when they sound legitimate.
Watch for unexpected login alerts, and enable two-factor authentication where the service offers it.

Payment card details were not among the exposed fields. Card reissue is not indicated by the disclosure, but checking statements for unfamiliar charges costs little.

What app owners should take from the case

For developers, the incident is a reminder that anything shipped inside a client app is public. Database credentials belong on a server behind an authenticated API, not in the app bundle. Once a secret has been exposed, it should be rotated, which the public statements do not confirm for this database.

The exposed records also show the cost of a leak. A customer table that includes birthdays, veteran status and IP addresses gives attackers more to work with than an email list alone.

Consumers should assume that secrets in any downloaded app can be extracted. The next concrete checkpoints are whether Dine Brands' investigation confirms an affected-customer count and whether the company states that the old credential has been rotated.

While we strive for accuracy, bytevyte can make mistakes. Users are advised to verify all information independently. We accept no liability for errors or omissions.

Sources

Applebee's customer data exposed by password left in app

✔Human Verified

Researched and cross-referenced against primary sources by the Bytevyte editorial team. This article was generated with the assistance of artificial intelligence and reviewed by the Bytevyte editorial team.