--- publish: true aliases: - tailtag created: 2026-07-12T17:55:57.560-04:00 modified: 2026-07-12T18:24:12.896-04:00 tags: - furry - AI - vibe-coding --- several online sources have indicated that the recently popular furry social app "[TailTag](https://www.playtailtag.com)" has been breached and had user information leaked to the public internet. > super props & excellent thread discussing this incident: https://bsky.app/profile/highlysuspect.agency/post/3mqhuc6bwds2r users were first made aware of the breach when they received a strange push notification from the app titled "IMPORTANT ANNOUNCEMENT" with the message body consisting primarily of "meows" and other cat noises. ![the notification in question](https://cdn.bsky.app/img/feed_fullsize/plain/did:plc:ulpgvc4gwpwrkyojtvkgp6bx/bafkreigbvhubsqqjvshaooffh543vbruyehxuyn6xam4tyvyayf6usy7ey) Finn's response: ![finn's response](https://x.com/FinnThePanther/status/2076144492558872939) ![second response](https://x.com/FinnThePanther/status/2076237596028723583) twitter user **@twnlink** did a lot of digging on this and discovered backend access was not entirely restricted to admins: ![](https://x.com/twnlink/status/2076177625433731536) twitter user [**@Benaclejames**](https://x.com/Benaclejames) posted the following technical write-up of the vulnerabilities discovered on their Notion page: https://app.notion.com/p/TailTag-Vulnerabilities-39bd16d9d17180fa9279ec92bbe19549 [**@FloppyMinty**](https://x.com/FloppyMinty) was able to confirm the app's backend information was still publicly accessible as of June 12th.[^2] Finn did later state in a separate post that the applied fix to the notifications issue should have fixed the access control issues as well.[^6] while no user passwords were compromised, just about every other bit of personally identifiable information that users entered into the application is publicly accessible, including email addresses and photos.[^1] as of writing, other than the publicly disclosed accesses of backend information already mentioned, there is no evidence any others have accessed or posted any data from the application. on July 12, 2026, Finn posted the following response: > On July 11, 2026, an unauthorized individual created several TailTag accounts and exploited an overly permissive profile-access rule to retrieve their full user profile records via the publicly accessible TailTag domain. This profile-access rule, originally designed so you could see the profile of whose fursuit you caught, included general profile information, along with account and app preferences, and technical identifiers used to deliver push notifications. In addition, a separate control requiring server authorization before notifications could be delivered that was assumed to be on by default had not been enabled. Together, these issues allowed the individual to send an unauthorized notification that appeared to come from TailTag itself. Once the incident was identified, I disabled all notification delivery, enabled the additional authorization requirement, rotated the relevant credential, blocked the accounts involved, revoked their sessions, and restricted profile access. Based on my investigation, I found no evidence that passwords or login credentials were accessed or that the individual gained access to other users' accounts to remove or otherwise manipulate user data. Notifications remain disabled while I complete longer-term security improvements. > > As benign as the notification content was, this was still a serious design oversight that will not be taken lightly, and I personally apologize for both the unintended app behavior, but more importantly, the loss of trust in the security of TailTag. I got caught up in the excitement of getting this project out for all of you to play that I overlooked some important details regarding account access control that resulted in this compromise. I suggest changing your password if you haven't already and be wary of any emails that look suspicious or ask for you to log in with TailTag credentials. If you choose to delete your account due to this, your data will be removed with no questions asked. > > I am still confident in the value that TailTag brings to the community and do not have any immediate plans to shut it down. However, I will be moving much more carefully in its development, including pausing any feature work until I am confident in account security. If you have any questions, please reach out and I will answer them for you. > > Many valuable lessons were learned this weekend. I will be doing my best to not only prevent something like this from happening again, but to gain your trust back for this project. [^3] > > \[in later tweets in reply to this original image post]: > If you would like to assist with future security, access control, or any other parts of the app, please reach out. I am happy to discuss how you can help.[^4] in the interim, TailTag has been **taken offline** until further notice.[^5] most of the comments in response to Finn's own statement were questions about the amount of AI assistance used in the creation of the app. Finn did say "LLMs were involved in the implementation of designs \[he] wrote in English."[^7] TailTag's website is still online as of writing. Updates to both the site and application are likely, though no timetable has been announced. change your passwords, folks, you'll be alright. [^1]: @BenacleJames: _TailTag Vulnerabilities_ - https://app.notion.com/p/TailTag-Vulnerabilities-39bd16d9d17180fa9279ec92bbe19549 [^2]: @FloppyMinty: "PSA: If you used TailTag, your email among other metadata has been compromised." https://x.com/FloppyMinty/status/2076320147233493306 [^3]: @FinnThePanther, X: "About yesterday's incident." https://x.com/FinnThePanther/status/2076351285415276672 [^4]: https://x.com/FinnThePanther/status/2076351646662345102 [^5]: https://x.com/FinnThePanther/status/2076401056414900312 [^6]: Finn said "the fix should have addressed this as well" a [couple of hours later](https://x.com/FinnThePanther/status/2076357929083801789) [^7]: https://x.com/FinnThePanther/status/2076378180840239389