The dating app that doxxed 72,000 women...

Fireship • 2025-07-30 • 3:52 minutes • YouTube

🤖 AI-Generated Summary:

The Rise and Fall of T: What the Massive Data Breach Teaches Us About App Security

Last week, a groundbreaking dating app designed exclusively for women, known as T, rocketed to the top of the App Store charts—only to implode spectacularly following one of the most embarrassing data breaches in recent memory. T’s unique concept was simple yet powerful: women could anonymously share stories, photos, and warnings about men they’d dated, helping others avoid bad experiences. However, this noble intention was undone by catastrophic security failures that compromised the privacy of thousands of users.

What Was T and Why Did It Matter?

T targeted a very specific niche in the online dating world. By allowing women to "dox" and gossip about men they dated, the app aimed to serve as a protective shield against bad actors on popular dating platforms like Tinder. Given that a small percentage of highly desirable men attract the majority of attention on these apps, T’s database likely contained candid accounts about some of the most sought-after individuals.

To use the app, women had to verify their identity by submitting a selfie alongside a government-issued ID, ensuring that only verified women could participate. While this verification step was intended to maintain community safety, it became a double-edged sword when the data was exposed.

How Did the Breach Happen?

On July 25th, T confirmed that an unauthorized party had accessed a legacy Firebase storage bucket critical to their infrastructure. This bucket was left completely unsecured—unencrypted and publicly accessible on the internet—making it shockingly easy for hackers to retrieve data. Approximately 72,000 images—including 13,000 selfies and ID photos—were compromised.

But the damage didn’t stop there. A few days later, another database was leaked containing more than 1.1 million posts, comments, and private messages. The fallout was immediate and severe, with personal data of thousands of women exposed and spread across platforms like 4chan.

The Fallout: Privacy Violated and Community Mocked

The leaked data led to an ironic and painful twist: the very community T aimed to protect found itself victimized. Users’ selfies and sensitive information flooded the internet, and instead of sympathy, many faced ridicule and harassment.

Online communities quickly seized the opportunity to mock the users, derogatorily nicknaming them “roasties.” Developers and hackers alike began experimenting with the exposed data, creating everything from detailed data analyses in Python to interactive maps plotting user location data in JavaScript. Some even built websites ranking users by their appearance—a disturbing invasion of privacy fueled by this careless breach.

The App’s Response: A Hollow Apology

In the wake of the breach, T’s team issued a statement that many saw as a non-apology filled with corporate jargon. They admitted that a legacy storage system was penetrated but failed to fully take responsibility or explain how such a critical security lapse could have occurred.

What made the breach especially egregious was that Firebase—the storage service used—warns repeatedly when buckets are left public. There are built-in alerts and email reminders indicating when data is accessible to anyone online. Yet, T’s developers ignored or missed these warnings. Notably, the app’s user interface promised that selfies would be deleted post-verification—a promise that turned out to be false.

Lessons Learned: The High Cost of Incompetence in App Development

Interestingly, the app was developed by Shawn Cook, a male coder with less than six months of professional experience according to LinkedIn. While some speculate that the app was a rushed “vibecoded” project lacking polish, the real takeaway is a cautionary tale about security negligence.

Firebase’s infrastructure is known for its ease of use, but with that comes the responsibility to configure security rules correctly. Leaving such sensitive data exposed isn’t just a mistake—it’s a fundamental failure in understanding or prioritizing user privacy.

The Bigger Picture: Data Security in a Changing Digital Landscape

The T breach underscores broader concerns about data protection, especially as governments implement stricter age verification laws for adult content and online safety. Apps requiring ID verification must be especially vigilant, as their data stores contain some of the most sensitive personal information imaginable.

The reality is that even well-intentioned apps can become liabilities if security isn’t baked into their design from the start. For developers, this means investing time and resources into proper data encryption, access controls, and regular audits.

How Developers Can Avoid Being the Next T

If you’re a developer or startup founder, the T breach is a stark reminder of why infrastructure choices matter. Firebase and similar platforms provide powerful tools—but they demand careful configuration.

For those looking to maintain control and security over their projects, consider alternatives like virtual private servers (VPS). Services like Hostinger offer affordable, flexible VPS hosting with multiple operating systems and pre-installed templates for popular frameworks. This approach gives developers full ownership of their environment and reduces the risk of accidental exposure due to misconfigured cloud services.

Final Thoughts

T’s meteoric rise and catastrophic fall is a cautionary tale for the tech world. A revolutionary concept meant to empower women was undone by poor security practices, ultimately harming the very community it sought to protect.

As users, always be aware of the data you share online and the risks involved. As developers, never underestimate the importance of securing your data—because once it’s out, there’s no taking it back.

Stay informed with the latest in tech and security by following our blog. If you’re a developer seeking reliable hosting solutions, check out Hostinger for great performance and control over your projects.

📝 Transcript (118 entries):

Last week, one of the most revolutionary dating apps for women, T, shot to the top of the App Store download charts and then immediately imploded after one of the most embarrassing data breaches of all time. Te is an app that can only be used by women to dox and gossip about men that they've gone out with on dating sites to warn other women about bad behavior before they go on a date. That means if you're one of the top 5% of desirable males who get 80% of the women on apps like Tinder, they're probably talking about you on tea. Unfortunately, on July 25th, T confirmed unauthorized access to a legacy Firebase storage bucket that was left completely and egregiously insecure. Around 72,000 images were compromised, 13,000 selfies, and ID photos. Then, just days later, another database was hacked that allegedly contains over 1.1 million shared posts, comments, and direct messages. In today's video, we'll find out how this app was compromised and look at all the hilarious stuff developers have been building with the hack data. It is July 30th, 2025, and you're watching the Code Report. The world is changing quickly. Just days ago, age verification for adult websites went into effect in the UK, and similar laws are also now in place in a handful of US states. We live in a dystopian world where Gooners now need to get permission from the government just for the privilege to goon online. Protecting kids from degenerate content is a good thing, but it's only a matter of time before one of these age verification data sets gets hacked. A tea app, which requires women to verify that they're women by taking a selfie with their ID, is a perfect example. It was cooked up by Shawn Cook, a male developer with over 6 months of coding under his belt, according to LinkedIn. But now, his app is cooked after this massive data breach was dumped on 4chan. And it's kind of sad that an app meant to help women stay safe ended up harming them instead.

4chan anons played the Uno reverse card when thousands of selfies of users on the T app were dumped and subsequently spread across the internet. And people are continuing to roast these tea users as we speak. The users of this app and the victims of the breach are being referred to as roasties. Vibe coders saw an opportunity to build all sorts of ridiculous apps based on this data. Like one guy used Python to do a detailed data exploration while another used JavaScript to take the location data from the hacked images and plot it on Google Maps while another person made a website to rank them based on their looks. After the breach went viral, the T team released a statement which was basically a non-apology with a bunch of corpo speak that explained how a legacy data storage system was penetrated non-consensually. What's especially egregious about this breach though is that the data was kept in a Firebase storage bucket. It completely unencrypted and unsecured just waiting to be found by someone on the internet.

And you actually have to go out of your way to screw up Firebase this bad because you get tons of warnings when you have a bucket or database with rules set to public along with email reminders that tell you anyone can access this data. In addition, in the UI, they tell users that they will delete your selfie after the verification process is done, but it appears that wasn't the case.

They were either lying or just highly incompetent as some have speculated that the app itself is just vibecoded slop, but I think that's highly unlikely because not even AI would screw up Firebase this bad. But between your AI coding agent bills, your AI girlfriend bills, and your cloud hosting bills, it's never been more expensive to be a 10x developer, which is why you should check out Hostinger, the sponsor of today's video. Their virtual private servers will give you the power and flexibility to run whatever you want without locking you into someone else's platform. And for less than 10 bucks per month, you get a respectable two CPUs and 8 GB of RAM. You can see how they have a bunch of operating systems to choose from. Or you could go with a pre-installed template like this one from Koolifi, which lets you easily deploy any framework like Nex.js or Astro. If you want freedom from our serverless overlords and a great developer experience, check out Hostinger at the link below for an even bigger discount. This has been the code report. Thanks for watching and I will see you in the next one.

YouTube Deep Summary