Bootlegger's Claude-built dashboard sent store and financial data to anyone who loaded its login page

What it is

MyBroadband (16 October 2026) reports that Bootlegger's CEO appears to have encouraged or directly built the dashboard with Claude. In a July LinkedIn post he described vibe-coding nightly and mandating Claude for his 15 direct reports.

According to the anonymous discloser, the URL was found because employees posted photos of their laptop screens on Instagram with the site visible.

The app showed a login screen, but the data was shipped down with the login page. MyBroadband verified that the page source contained names and contact information linked to 132 Bootlegger locations, along with some performance and financial data.

Neither the CEO nor Bootlegger commented, but the Railway app was taken down after MyBroadband's query.

How to check

1. Log out (or use a private window), load your app's login page and view the page source and the network tab. Is any real data in the HTML, inline JSON or API responses before you sign in?
2. Call your API endpoints with no session cookie or token. They should return 401/403, not data.
3. Search for your internal tool's hostname online. "Internal" URLs leak through screenshots, links and logs.

How to fix

1. Enforce auth on the server: the server must check the session before it renders or returns any data. A login screen drawn in the browser is not access control.
2. Load data only after sign-in, from endpoints that check who's asking and return only what that user may see.
3. Put internal dashboards behind an access layer (SSO, a VPN or your host's private networking) rather than relying on an obscure public URL.
4. When you have an AI build an internal tool, ask it to explain where auth is enforced, and test logged-out access yourself before sharing the link.

# Logged-out checks: neither should contain real records
curl -s https://your-dashboard.example.com/login | grep -iE 'email|phone|revenue|"stores"' | head
curl -s -o /dev/null -w '%{http_code}\n' https://your-dashboard.example.com/api/stores   # expect 401/403

Sources

• MyBroadband: South African coffee franchise exposes company and private data in vibe-coded web application ↗