What happened

Restaurant chain Applebee's left a database password hardcoded inside its mobile app. Anyone who inspected the app could find the key and use it to reach the database, leaving customers' personal data exposed on the web.

Why it matters

Anything shipped inside a mobile app or front-end code should be treated as public. Attackers routinely unpack apps looking for embedded keys, and a single hardcoded secret can open an entire backend.

How to protect your AWS environment

• Never embed database passwords or AWS keys in apps; store them in AWS Secrets Manager or Parameter Store.
• Put an authenticated API between your app and your database instead of connecting directly.
• Run secret scanning in your CI/CD pipeline to catch keys before they ship.

Source: Click to Read the original report (TechCrunch)