85Trust
Highly Accurate
🔍 Web Verified
kantorkelonMastodon2d ago
Die Entwicklung der Fitness- und Zyklus-Tracking-App „femify“ wurde in einem Podcast als weitgehend „vibe coded“ beschrieben.¹
Diese Aussage nahm eine technisch versierte Person zum Anlass, die Anwendung näher zu untersuchen... und stolperte über Daten von 8.000 Nutzer*innen: https://www.ccc.de/de/disclosure/femify-selbstbeforderung-zum-admin-dank-vibe-coding
¹ https://www.youtube.com/watch?v=9FEzXpxCnCw?t=2950 (auf eigene Gefahr...)
#femify #disclosure #vibecoding
Trust Metrics
88
85
80
82
Accuracy88%
Framing85%
Context80%
Tone82%
Analysis Summary
The Chaos Computer Club disclosed a critical security flaw in the femify fitness tracking app where users could grant themselves admin privileges through browser developer tools, exposing data from approximately 8,000 users. The vulnerability was discovered after a podcast described the app's development as largely "vibe coded"—a criticism of unstructured, intuition-driven development practices. Femify patched the vulnerability after notification on March 26, 2026, though it remains unclear whether affected users were informed of the breach. This incident exemplifies how poor coding practices and missing access controls can create surprisingly simple paths to sensitive data exposure.
Claims Analysis (4)
“A fitness and cycle tracking app called 'femify' was described in a podcast as largely 'vibe coded'”
Linked podcast and CCC disclosure both confirm this description was made in a podcast episode discussing the app's development approach.
“A technically versed person investigated the app and discovered data from 8,000 users could be accessed”
CCC disclosure report confirms this finding. The vulnerability allowed unauthorized access to approximately 8,000 user records.
“Registered users could assign themselves admin rights using simple browser developer tools”
CCC disclosure explicitly states users could self-promote to admin status using browser Developer Tools without authentication, enabling wider data access.
“The vulnerability was reported to Femify on March 26, 2026 and was patched promptly”
CCC disclosure confirms notification date and states the vulnerability was fixed in timely fashion after responsible disclosure.
Was this analysis helpful?
Try ClearFeed free →