---
type: "post"
id: "a-coffee-chain-s-vibe-coded-dashboard-leaked-e75f1e"
slug: "a-coffee-chain-s-vibe-coded-dashboard-leaked-e75f1e"
title: "A coffee chain's vibe-coded dashboard leaked data on 132 locations : employees posted photos of their screens on Instagram, and people found contact details and financial data sitting in the login..."
description: "The thesis is: a login screen is not an access boundary when sensitive data is already sent to an unauthenticated browser."
retrieval_nugget: "The thesis is: a login screen is not an access boundary when sensitive data is already sent to an unauthenticated browser."
published_at: "2026-10-19"
updated_at: "2026-10-19"
record_date: "2026-10-19"
date_kind: "published_at"
topics: ["claude"]
source_urls: ["https://mybroadband.co.za/news/software/672602-south-african-coffee-franchise-exposes-company-and-private-data-in-vibe-coded-web-application.html"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:a-coffee-chain-s-vibe-coded-dashboard-leaked-e75f1e"
status: "published"
visuals: []
editorial_provenance: {"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:bcae4c2f6d359a0c3157279965cc9e5e32b8d829659859c476fb1f7748f92915","reviewed_at":"2026-10-19T11:02:18.161Z","source_evidence_count":1,"verified_claim_count":3,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":3,"implication_count":1,"watch_condition_count":1,"related_record_count":0}
analysis: {"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"a login screen is not an access boundary when sensitive data is already sent to an unauthenticated browser.","observed_facts":[{"text":"MyBroadband reported exposed data associated with 132 Bootlegger locations, including names and contact details and some performance and financial data.","source_urls":["https://mybroadband.co.za/news/software/672602-south-african-coffee-franchise-exposes-company-and-private-data-in-vibe-coded-web-application.html"]},{"text":"The dashboard displayed a login screen, but the report says data was present in page code and visible to anyone with the URL.","source_urls":["https://mybroadband.co.za/news/software/672602-south-african-coffee-franchise-exposes-company-and-private-data-in-vibe-coded-web-application.html"]},{"text":"MyBroadband says the dashboard was taken down after its inquiry; Bootlegger and its CEO had not responded by publication.","source_urls":["https://mybroadband.co.za/news/software/672602-south-african-coffee-franchise-exposes-company-and-private-data-in-vibe-coded-web-application.html"]}],"mechanism":"A presentation-level login view cannot protect data delivered to the browser before the server enforces authorization.","why_now":"AI-assisted development can make internal tools quick to build, but speed does not change the requirement to test what an unauthenticated request receives.","implications":["teams should inspect network responses in an unauthenticated session, not infer protection from a login screen."],"evidence_boundary":"one reported incident, based on MyBroadband’s verification; the source does not establish the specific developer, the causal role of AI, or whether data was accessed or misused beyond discovery.","watch_conditions":["whether Bootlegger provides a further account of the incident or adopts controls that keep location and financial data server-side until authorization is confirmed."],"related_records":[],"new_branch_reason":"No prior New Runtime record was supplied for this specific dashboard exposure; this starts a distinct incident analysis without assuming a related earlier record."}
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/a-coffee-chain-s-vibe-coded-dashboard-leaked-e75f1e/","markdown":"https://newruntime.com/posts/a-coffee-chain-s-vibe-coded-dashboard-leaked-e75f1e.md","json":"https://newruntime.com/posts/a-coffee-chain-s-vibe-coded-dashboard-leaked-e75f1e.json"}
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
---

# A coffee chain's vibe-coded dashboard leaked data on 132 locations : employees posted photos of their screens on Instagram, and people found contact details and financial data sitting in the login...

## Retrieval answer

The thesis is: a login screen is not an access boundary when sensitive data is already sent to an unauthenticated browser.

The thesis is: a login screen is not an access boundary when sensitive data is already sent to an unauthenticated browser. MyBroadband reported that Bootlegger’s dashboard exposed data associated with 132 locations, including names and contact details, plus some performance and financial data. The page displayed a login screen, yet the outlet says the data was present in the page code and visible to anyone with the URL.

The mechanism is: A presentation-level login view cannot protect data delivered to the browser before the server enforces authorization. The report says the URL was noticed after employees posted screen photos on Instagram, and that MyBroadband verified the data. The dashboard was taken down after the outlet’s inquiry. Why now: AI-assisted development can make internal tools quick to build, but speed does not change the requirement to test what an unauthenticated request receives. The report links the CEO’s use of Claude for internal software to the broader context, but does not show that Claude authored this flaw.

The first implication is: teams should inspect network responses in an unauthenticated session, not infer protection from a login screen. The evidence boundary is: one reported incident, based on MyBroadband’s verification; the source does not establish the specific developer, the causal role of AI, or whether data was accessed or misused beyond discovery. The first watch condition is: whether Bootlegger provides a further account of the incident or adopts controls that keep location and financial data server-side until authorization is confirmed.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Claude](https://newruntime.com/topics/claude.md): Explore the claude topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)