The Tea App Breach: What Happens When ‘Safety’ Becomes a Security Risk?
Key Takeaways Two major breaches exposed sensitive data — Tea app leaked thousands of selfies, government IDs, and over 1.1 million private messages, including names, contact details, and deeply personal conversations. Poor security practices enabled attacks — An unsecured Firebase database and an exploitable API left user data wide open, showing a lack of encryption and proper access controls. AI-driven “vibe coding” played a role — Heavy reliance on AI-generated code without audits likely introduced vulnerabilities, highlighting the security risks of unreviewed AI-assisted development. Severe privacy and safety fallout — Leaked data is being exploited online, putting users at risk of doxxing, harassment, and legal consequences in sensitive cases like abortion discussions. What if the “anonymous” dating app you used to warn women about toxic men accidentally leaked your selfie, ID, messages, and contact details? That’s exactly what happened to users of Tea (officially Tea Dating Advice): a women-only “dating safety” app designed to help women share information about men in their area. To join, women must upload a selfie and a government-issued ID to verify their identity. Once they’re in, they’re encouraged to share experiences, raise red flags, and connect with others for mutual support and protection. In a surprising turn for its mission, Tea has now experienced two major data breaches: one exposed photos and IDs, and the second leaked over a million messages sent in (admittedly misplaced) confidence. Some of these messages discuss abortions, cheating partners, and personal details like car models and social handles. Both types of breaches are now being exploited online, with some images turned into public rankings and private data used to dox or mock users. So how did an app whose mission was to make women safer end up doing the exact opposite in one of the worst privacy disasters of the year? Let’s take a closer look. What Got Leaked, and Why It’s So Serious The first Tea breach drew a lot of negative attention. An exposed Firebase database left tens of thousands of selfies and government IDs accessible to anyone. 4chan users quickly scraped the images and made mirror downloads. They even set up a Facemash-style site where people ranked leaked selfies by attractiveness, including leaderboards. Tea’s initial response was disappointing. The company minimized the breach, claiming it only involved “legacy” data from over two years ago. Sadly for them, that defense quickly fell apart. A second, much larger breach has now exposed over 1.1 million private messages, with many of these sent as recently as last week. These weren’t just casual DMs. They included: Women discussing abortions Users realized they were dating the same men Real phone numbers, names, and social media handles Accusations of cheating, abuse, and more, often naming people directly To make matters worse, a researcher found out it was possible to use the app’s API to send a notification to every single user. Tea marketed itself as a place to stay anonymous. The nature of these leaks showed that it was anything but: with full identities linked to deeply personal conversations, users could now face blackmail, harassment, or worse. A Case Study in Negligence: How It Happened Tea’s backend was shockingly insecure for an app that promised safety, not once, but twice. The initial breach involved a completely unsecured Firebase storage instance. That alone exposed over 72,000 images, including 13,000 selfies, government-issued IDs, and 59,000 images from posts, messages, and comments. In a statement, Tea claimed the breach only affected data stored on its “legacy data system.” That claim didn’t last long, though. Just days later, security researcher Kasra Rahjerdi uncovered a second, more serious vulnerability: Tea’s API allowed any logged-in user to access a recent, unsecured database using their API key, which included private messages from as recently as last week. Rahjerdi discovered something even more alarming in his research: push notifications could be sent to all users using the same attack vector. Tea claims it has since fixed the vulnerability and contacted law enforcement. But it’s too little too late: the damage has been done. The data has already been scraped, archived, and widely shared online. The app was marketed as discreet and anonymous, but the reality was closer to leaving the door wide open and hoping no one walked in. Vibe Coding, AI Tools, and Faking Competence Tea Dating Advice didn’t just have bad luck. It also suffered from poor development practices and likely relied too much on AI-generated code. According to the original hacker who revealed the first breach on 4chan, Tea was a prime example of “vibe coding”: a rising trend where developers rely heavily on AI tools to build products without proper security checks, version control, or code reviews. Guillermo Rauch, founder and CEO of AI cloud app company Vercel, offered a sardonic take on this trend: “On Tea Dating, AI and Vibe Coding security TL;DR: the antidote for mistakes AIs make is… more AI.” Unfortunately for Tea, and even more so for the women who used it, that approach appears to have backfired. A Georgetown University study found that 48% of AI-generated code had security flaws. Tech consultant Santiago Valdarrama gets it right: “Vibe coding is awesome, but the code these models generate is full of security holes and can be easily hacked.” This kind of AI-assisted (or, in all honesty, AI-led) development might help quickly ship features. But without oversight, it also ships vulnerabilities. The Ongoing Repercussions of Tea’s Breach Tea promised its users a private space to share sensitive stories, from relationship red flags to personal trauma. Sadly, it ended up turning those confessions into liabilities. After the initial breach, photos of women who used the app were scraped and reposted on 4chan. Soon after, they were transformed into a Facemash-style site that ranked their appearances. Many of these pictures were voted on tens of thousands of times, erasing any anonymity and dignity from these women instantly. The second breach surpasses the first by a large margin. It includes genuine conversations between real women, discussing
The Tea App Breach: What Happens When ‘Safety’ Becomes a Security Risk? Read More »