How Broken OTPs and Open Endpoints Turned a Dating App Into a Stalker’s Playground

Vulnerabilities in the Cerca dating app exposed sensitive personal information, including OTPs, allowing unauthorized access to user accounts. Unprotected endpoints revealed private data like sexual preferences and passport information, posing grave privacy risks. The author discovered these flaws, reported them to Cerca, but as of publication, users remained uninformed. The incident underscores the need for startups to prioritize security over rapid market entry.