u/Born_Excuse_5610

Hello everyone,

I’m Zachi, a software engineer and security researcher with about 6 years of experience. During this time, I’ve conducted security tests on over 200 apps, and in more than 70 cases, I found critical vulnerabilities (SEV-1) in apps with 10+ million users.

I’m currently planning a curated portfolio of smaller Android apps to identify patterns and use them to guide further research. This means you’ll receive a security review, which typically costs in the four-digit range, for free. I don’t have, nor do I want, any special access; I work with the same permissions as any external tester. I'll use the network traffic and extract the apk, everyone could do that.

The only requirements are active permission to perform non-permanently harmful tests against your backend and your consent to allow me to publish the findings, anonymized if necessary, on my blog.

All findings will be presented to you, including fixes. Nothing will be published until it has been fixed.

If you’re interested, you can either contact me directly here on reddit, in the comments or via email at me@zachi.dev

I tested an iOS app called Miracle: Baby Photo Editor (version 2.2.0) and found something I think parents should know about.

The app’s privacy policy explicitly states:
“We do not sell personal data, and we do not use your photos or your child’s data for advertising.”
So I recorded the app’s network traffic on my own device to see what actually happens.

During onboarding and normal use, I observed the app transmitting child-related information to third parties.

Mixpanel received:
the child’s first name
gender
age in months
age bracket

Those attributes were associated with a persistent Firebase user ID.

The Mixpanel request also contained ip=1, which allows Mixpanel to use the connecting IP address for geolocation/profile enrichment.

But what surprised me most was this:
Facebook App Events received the child’s age in months.
This happened even though Apple App Tracking Transparency had been denied.

I did not see any separate consent screen asking the parent for permission to send their child’s information to Meta/Facebook.

To be precise: seeing a value sent through Facebook App Events does not by itself prove that Meta subsequently used that specific value to target an advertisement.

But Facebook App Events is infrastructure used for app analytics, attribution and advertising measurement.
And that makes the privacy-policy statement:
“we do not use … your child’s data for advertising”
particularly concerning when the app is transmitting a child’s age directly into Meta’s App Events infrastructure without clearly disclosing it.

Even if the developer argues that this is “analytics only,” there is still another major problem:

The privacy policy does not appear to tell parents that their child’s name, gender and age are being transmitted to Mixpanel and Facebook in the first place.
This isn’t based on SDK detection or speculation.
I captured the actual outbound requests and the exact fields being transmitted.

I contacted the developer today and asked them to immediately stop transmitting child-related attributes to third-party analytics/advertising services, investigate deletion of previously collected data, and correct their privacy disclosures.

I’m giving them an opportunity to respond.
For a baby/child-focused app, I think parents deserve to know exactly where their children’s information is going.

Assalamu alaikum.

Quick context for anyone who missed it: back in 2020 it came out that Muslim Pro (built by Bitsmedia) was funneling users' location data to a data broker that had ties to US military contractors. Huge story. The company apologized, said they'd cut ties, and promised they take our privacy seriously.

I do security research on mobile apps, you may have seen my post in this sub about the Pillars app (minor privacy things, they fixed everything immediately). Some time ago I tested the current version of Muslim Pro to see whether anything had actually improved. What I found was bad enough that I reported it to them privately and gave them time to fix it, the standard, responsible way. It's now been over 100 days. No response. No fix. So I'm bringing it to the community, because it's your data.

Here's what I can say in plain terms, without handing anyone a how-to:

• The in-app community ("Ummah") is readable by anyone without an account being required. Posts where people talk about prayer, health, family problems, even divorce, are exposed. Along with your location and gender.
• The "private profile" setting doesn't actually hide you. You can switch it on and your profile and posts are still pullable. It's basically cosmetic.
• The app can send your precise GPS location before you even log in, the opposite of what their own privacy policy claims.
• With nothing more than an ordinary account, real names and dates of birth can be tied to your public profile.

To be fair, because I'm not here to spread panic: the specific 2020 setup (the location-broker pipeline) I did not find active in the current version. So this isn't "they're selling you to the military again." The problem is different and honestly more fundamental: the app is leaky by design. Your identity, your location, and what you do religiously inside it are far more exposed than a prayer app has any excuse for, and the one switch that's supposed to protect you doesn't work.

For an app used by tens of millions of Muslims, including people in places where being identified as practicing, or being geolocated at a mosque, is genuinely dangerous, that's not acceptable.

My honest recommendation: delete it. There are prayer-time / Qibla / Quran apps that don't require an account, don't run a social feed, and don't beam your location around.

At the very least, if you keep it: revoke location permission entirely, never post in the community, and assume anything you've already put in there is public.

I'm not trying to start drama I gave them every chance to fix this quietly first. Happy to answer questions.

Edit: Head Engineer replied to my reminder mail.

Spoiler: The fixed-claimed exploits are still open.

Here’s the first part of my answer:

Ualaykum As-Salam [redacted],

I re-tested on 23 August 2026, between roughly 00:00and 02:00 UTC. Setup, so you can match it against your logs: a clean Google Play install of 17.7.1 (versionCode 1707010301, installed 01:50 local time) on a fresh emulator, plus direct API calls. My own test account for anything authenticated. For the [redacted], the same [redacted] as in the original report.

One of the three items you reported as fixed is fixed. The other two are not, and I can still reproduce them on production as I write this.

I want to be honest with you: [redacted], this is not acceptable. Muslim Pro is at close to 200 million downloads. The privacy of the people who open this app to pray is an amaanah in your hands, and a status email does not discharge it. Two of the three things you told me were fixed still hand the same data to anyone with [redacted]. I had that result in the first ten minutes, which tells me nobody checked against production before your mail went out. I would rather not have to bring up X-Mode again in this correspondence, and telling a researcher that something is closed while it is still open is the fastest way to get us there.

Every canvas action is an AI-callable tool, so the AI designs the screenshots step by step and you can edit anything afterwards. MIT licensed, feedback and contributors welcome.

I kept writing the same throwaway scripts to hit the Admin GraphQL API — list products, patch a few metafields, check inventory before a migration — and got tired of wiring up auth and queries every time. So I built a small CLI to scratch that itch, and put it on GitHub under MIT in case it’s useful to anyone else here.

Full disclosure: it’s my project. I’m posting because I’d genuinely like feedback from people who live in this API daily, not to sell anything (it’s free and open source).

The idea is that it’s a thin layer — it doesn’t wrap the API behind hand-written helpers that go stale. It introspects your store’s live schema and lets you call any QueryRoot / MutationRoot field directly:

shopi read products --first 10 --select 'nodes { id title status }'
shopi write productCreate --input @product.json --confirm
shopi gql --query '{ shop { name plan { publicDisplayName } } }'

A few design decisions I’d love opinions on:
• Every write is gated behind an explicit --confirm, with --dry-run to preview the generated GraphQL first.
• Tables in a terminal, JSON in pipes/CI automatically.
• Credentials are exchanged for a short-lived Admin token on each run, nothing sensitive written to disk.
• It can never bypass access scopes — each op only works if the app was installed with the matching read_* / write_* scope.

Runs on Bun, no runtime dependencies. There’s also an experimental set of agent “skills” so coding agents can drive it, but the CLI stands on its own.

Honest questions for this sub: does a schema-introspection approach hold up in your real workflows, or do you end up wanting opinionated wrappers anyway? And is --confirm on every mutation too much friction for bulk work? Tear it apart.

Hey everyone,

I’m pulling my hair out trying to get a simple, clear overview of my store's performance. The native Shopify dashboard feels surprisingly clunky to navigate for what I need, and don't even get me started on Google Analytics. GA4 is absolute hell and way too overly complicated just to see basic tracking and where my sales are actually coming from.

I recently tested an app called ShopiTrack to see if a third-party tool would help. Honestly, it’s exactly what I was looking for, super clean interface, straightforward attribution, and it gave me great input right away without needing a degree in data science.

My only issue is that they charge $10/month for it. I know it's a business tool, but I’m really trying to bootstrap right now and keep my monthly app overhead as close to zero as possible.

Does anyone know of a completely free alternative that offers this level of simplicity? Or am I just being too cheap and should bite the bullet on the 10 bucks?

Thanks.

I see a lot of merchants here assuming that once the bank sides with the buyer on a chargeback, the money is gone forever.

That’s a myth.

A chargeback is just a bank's internal policy decision, not a legal verdict. The bank reversing the charge doesn't magically void the customer's legal debt to you.
If you have solid proof that an order was legit (especially for domestic orders), you can still send them to collections or take them to small claims court.

Don't just roll over because a payment processor said no. If you have the receipts, you still have options.
(Obligatory: not legal advice, just a heads-up).