pxdg/paxad
1
1
Fork 0
mirror of https://github.com/pxdg-afk/paxad.git synced 2026-08-22 20:21:07 -04:00
Code Issues Packages Projects Releases Wiki Activity

Published 1 file

Browse Source
This commit is contained in:
Quartz Syncer
2026-07-12 18:05:34 -04:00
parent 03be7bd6c2
commit 5098abcfdb
1 changed files with 13 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
content/fnn/TailTag App Discussion.md
View File

@@ -1,17 +1,20 @@
--- ---
publish: true
aliases: aliases:
- tailtag - tailtag
created: 2026-07-12T17:55:57.560-04:00
modified: 2026-07-12T18:04:56.514-04:00
tags: tags:
- furry - furry
- AI - AI
- vibe-coding - vibe-coding
publish: false
--- ---
several online sources have indicated that the recently popular Pokémon GO-like app "[TailTag](https://www.playtailtag.com)" has been breached and had user information leaked to the public internet.
several online sources have indicated that the recently popular Pokémon GO-like app "[TailTag](https://www.playtailtag.com)" has been breached and had user information leaked to the public internet.
> props & excellent thread discussing this incident: https://bsky.app/profile/highlysuspect.agency/post/3mqhuc6bwds2r > props & excellent thread discussing this incident: https://bsky.app/profile/highlysuspect.agency/post/3mqhuc6bwds2r
users were first made aware of the breach when they received a strange push notification from the app titled "IMPORTANT ANNOUNCEMENT" with the message body consisting primarily of "meows" and other cat noises. users were first made aware of the breach when they received a strange push notification from the app titled "IMPORTANT ANNOUNCEMENT" with the message body consisting primarily of "meows" and other cat noises.
![the notification in question](https://cdn.bsky.app/img/feed_fullsize/plain/did:plc:ulpgvc4gwpwrkyojtvkgp6bx/bafkreigbvhubsqqjvshaooffh543vbruyehxuyn6xam4tyvyayf6usy7ey) ![the notification in question](https://cdn.bsky.app/img/feed_fullsize/plain/did:plc:ulpgvc4gwpwrkyojtvkgp6bx/bafkreigbvhubsqqjvshaooffh543vbruyehxuyn6xam4tyvyayf6usy7ey)
@@ -32,13 +35,13 @@ twitter user [**@Benaclejames**](https://x.com/Benaclejames) posted the followin
on July 12, 2026, Finn posted the following response: on July 12, 2026, Finn posted the following response:
> On July 11, 2026, an unauthorized individual created several TailTag accounts and exploited an overly permissive profile-access rule to retrieve their full user profile records via the publicly accessible TailTag domain. This profile-access rule, originally designed so you could see the profile of whose fursuit you caught, included general profile information, along with account and app preferences, and technical identifiers used to deliver push notifications. In addition, a separate control requiring server authorization before notifications could be delivered that was assumed to be on by default had not been enabled. Together, these issues allowed the individual to send an unauthorized notification that appeared to come from TailTag itself. Once the incident was identified, I disabled all notification delivery, enabled the additional authorization requirement, rotated the relevant credential, blocked the accounts involved, revoked their sessions, and restricted profile access. Based on my investigation, I found no evidence that passwords or login credentials were accessed or that the individual gained access to other users' accounts to remove or otherwise manipulate user data. Notifications remain disabled while I complete longer-term security improvements. > On July 11, 2026, an unauthorized individual created several TailTag accounts and exploited an overly permissive profile-access rule to retrieve their full user profile records via the publicly accessible TailTag domain. This profile-access rule, originally designed so you could see the profile of whose fursuit you caught, included general profile information, along with account and app preferences, and technical identifiers used to deliver push notifications. In addition, a separate control requiring server authorization before notifications could be delivered that was assumed to be on by default had not been enabled. Together, these issues allowed the individual to send an unauthorized notification that appeared to come from TailTag itself. Once the incident was identified, I disabled all notification delivery, enabled the additional authorization requirement, rotated the relevant credential, blocked the accounts involved, revoked their sessions, and restricted profile access. Based on my investigation, I found no evidence that passwords or login credentials were accessed or that the individual gained access to other users' accounts to remove or otherwise manipulate user data. Notifications remain disabled while I complete longer-term security improvements.
> >
> As benign as the notification content was, this was still a serious design oversight that will not be taken lightly, and I personally apologize for both the unintended app behavior, but more importantly, the loss of trust in the security of TailTag. I got caught up in the excitement of getting this project out for all of you to play that I overlooked some important details regarding account access control that resulted in this compromise. I suggest changing your password if you haven't already and be wary of any emails that look suspicious or ask for you to log in with TailTag credentials. If you choose to delete your account due to this, your data will be removed with no questions asked. > As benign as the notification content was, this was still a serious design oversight that will not be taken lightly, and I personally apologize for both the unintended app behavior, but more importantly, the loss of trust in the security of TailTag. I got caught up in the excitement of getting this project out for all of you to play that I overlooked some important details regarding account access control that resulted in this compromise. I suggest changing your password if you haven't already and be wary of any emails that look suspicious or ask for you to log in with TailTag credentials. If you choose to delete your account due to this, your data will be removed with no questions asked.
> >
> I am still confident in the value that TailTag brings to the community and do not have any immediate plans to shut it down. However, I will be moving much more carefully in its development, including pausing any feature work until I am confident in account security. If you have any questions, please reach out and I will answer them for you. > I am still confident in the value that TailTag brings to the community and do not have any immediate plans to shut it down. However, I will be moving much more carefully in its development, including pausing any feature work until I am confident in account security. If you have any questions, please reach out and I will answer them for you.
> >
> Many valuable lessons were learned this weekend. I will be doing my best to not only prevent something like this from happening again, but to gain your trust back for this project. [^3] > Many valuable lessons were learned this weekend. I will be doing my best to not only prevent something like this from happening again, but to gain your trust back for this project. [^3]
> >
> \[in later tweets in reply to this original image post]: > \[in later tweets in reply to this original image post]:
> If you would like to assist with future security, access control, or any other parts of the app, please reach out. I am happy to discuss how you can help.[^4] > If you would like to assist with future security, access control, or any other parts of the app, please reach out. I am happy to discuss how you can help.[^4]
@@ -46,7 +49,7 @@ In the interim, TailTag has been **taken offline** until further notice.[^5]
most of the comments in response to Finn's own statement were questions about the amount of AI assistance used in the creation of the app. Finn did say "LLMs were involved in the implementation of designs \[he] wrote in English."[^7] most of the comments in response to Finn's own statement were questions about the amount of AI assistance used in the creation of the app. Finn did say "LLMs were involved in the implementation of designs \[he] wrote in English."[^7]
[^1]: @BenacleJames: *TailTag Vulnerabilities* - https://app.notion.com/p/TailTag-Vulnerabilities-39bd16d9d17180fa9279ec92bbe19549 [^1]: @BenacleJames: _TailTag Vulnerabilities_ - https://app.notion.com/p/TailTag-Vulnerabilities-39bd16d9d17180fa9279ec92bbe19549
[^2]: @FloppyMinty: "PSA: If you used TailTag, your email among other metadata has been compromised." https://x.com/FloppyMinty/status/2076320147233493306 [^2]: @FloppyMinty: "PSA: If you used TailTag, your email among other metadata has been compromised." https://x.com/FloppyMinty/status/2076320147233493306