Bootlegger's internal BOS dashboard sent franchise contacts and sales data with its login page

Incident · BOS, an internal Bootlegger operations dashboard hosted on Railway (MyBroadband describes it as vibe-coded) · MEDIUM

Incident dateUnknown start; the forum disclosure thread claims the dashboard was public for months and indexed by Google by July 2026. Taken offline Oct 15, 2026.

DisclosedOct 15, 2026 (Bootlegger aware; MyBroadband query). Public Oct 16, 2026 (MyBroadband).

Added hereOct 16, 10:30 AM ET

Last verifiedOct 16, 2026

Summary

Sourcing: one outlet's report plus company confirmation; we found no independent second source. MyBroadband reported on Oct 16, 2026 that a web dashboard used by Bootlegger, the South African coffee franchise, showed a login screen but shipped company data inside the login page itself, readable in the page source by anyone with the URL. MyBroadband says it verified the exposed data, which included names and contact details linked to 132 Bootlegger locations plus some performance and financial data. The app, hosted on Railway, was taken down after MyBroadband asked for comment. CEO Ricky Ruthenberg confirmed that a legacy version of the dashboard, called BOS, had information 'not protected by its login': business performance data, cafe pipeline information, Google listing details, and the names, emails and mobile numbers of franchisees, operators and general managers. Bootlegger says the platform went fully offline on Oct 15, held no customer data, and that it has no evidence its databases or core systems were accessed. It says it will notify South Africa's Information Regulator under POPIA and is contacting the people affected.

Severity

MEDIUM Medium (VibeIncidents editorial rating). Personal contact details of franchisees, operators and managers, plus internal sales and pipeline data, were readable by anyone who found the URL, and the disclosure thread claims that was possible for months. We rate it Medium rather than High because Bootlegger says no customer data was on the platform, there is no evidence so far of access to core systems, and the app came down the same day it was flagged.

Timeline

Jul 1, 2026
Ruthenberg writes on LinkedIn about six weeks of vibe-coding with Claude and says he mandated Claude for his 15 direct reports.
Jul 2026
According to the MyBroadband forum disclosure thread (not independently confirmed), the dashboard was already indexed by Google by July.
Oct 15, 2026
Bootlegger says it learned of the issue that afternoon and took the legacy BOS platform fully offline the same day, after MyBroadband asked for comment.
Oct 16, 2026
MyBroadband publishes its report, then a follow-up carrying Ruthenberg's response and the POPIA notification plan.

How it happened

MyBroadband's account is that the dashboard looked protected but was not. An anonymous poster on the MyBroadband forums and Reddit said the URL surfaced when Bootlegger employees posted photos of their laptop screens on Instagram. People who opened the page and read its source found that the app sent a large amount of data down with the login page itself, before anyone signed in. The login form only controlled what was drawn on screen; the data was already in the browser. Bootlegger says this was a legacy copy of BOS: the live tool had already moved to a secure environment, but historical data on the old deployment had not been fully decommissioned. MyBroadband reported that Ruthenberg 'appears to have encouraged or directly developed' the dashboard using Claude, and Ruthenberg has publicly promoted vibe-coding with Claude. Neither MyBroadband nor Bootlegger has said which tool produced this specific code, and we do not claim it. The pattern itself is common in AI-built apps: a login screen is added in the frontend while the backend, or the page bundle, still hands every visitor the full dataset.

How to check your app

Open your app's login page in a private window while signed out, then view the page source and the browser's Network tab. If you can see records, names, emails or figures before signing in, so can anyone else.
Enforce authorization on the server for every request that returns data. A login screen in the frontend is not access control; an unauthenticated API call or embedded JSON blob should return nothing.
Search your built JavaScript bundles and server-rendered HTML for embedded data, API keys and initial-state blobs that ship to every visitor.
List every hosted deploy you have, including preview, staging and legacy copies on platforms such as Railway, Vercel or Netlify. Take down or put auth in front of any you no longer use, and delete the data they hold.
Check whether old URLs are indexed: search your domain and hosting subdomains with site: queries, and remove anything that should not be public.
If personal data was exposed, follow your local notification rules. Bootlegger's POPIA notification to the Information Regulator is the right model for South African companies.

Sources

Corrections and updates

None. Re-checked against every source on Oct 16, 2026.

Bootlegger fixed this the same day it was flagged. If you want to check your own AI-built app for data that loads before sign-in, LockedVibe offers a free Lockdown Pack and a scan. LockedVibe is our sister company (same owner) and has no say over this entry. Disclosure.