The Password Was Inside the App You Downloaded

You download a hotel app to book a room. You type in your name, your email, maybe join the rewards programme. What you don't know is that the app you just installed is carrying something extra — the password to the company's own customer database.

That is, in plain terms, what happened at Wyndham.

Security researcher Robert Wiggins, of a firm called What Security, was picking apart the source code of Wyndham's Android app — code any curious person can extract from a copy of the app — and found a password sitting inside it. Not a hint of one. The actual credential. It opened an internal Wyndham database, hosted by Salesforce, holding customer names, email addresses and Wyndham member numbers.

It also held something worse than names: customer login tokens — called JWTs — that keep you signed in without retyping your password. With one of those, you don't need someone's password at all. You just are them, as far as the app is concerned. Wyndham files and documents were in there too.

Wiggins told TechCrunch the database held millions of entries, though he couldn't pin down an exact exposed count. For scale, Wyndham says it has around 129 million enrolled rewards members. Millions is the floor, not the ceiling — and nobody, including Wyndham, has put a number on it yet.

Developers have a name for what went wrong: hardcoding. A password baked into software that ships to the public is not really a secret anymore, because anyone with a copy of the software can dig it out. It's the digital equivalent of taping the safe combination to the front door. Every security checklist bans it, and it keeps happening anyway — the app works fine with the password in it, right up until someone looks.

Here's the part that stayed with me, though. It isn't the password. It's what happened when Wiggins tried to tell someone.

Wyndham, it turns out, had no way for a researcher to report a flaw. No bug bounty page, no security contact he could use. So Wiggins asked TechCrunch for help reaching the company — and only after the journalists made contact did Wyndham revoke the credential and shut the door.

A good-faith researcher finds your front door open, and the only way he can tell you is through a newspaper. The vulnerability wasn't just in the app. It was in the process around it — there was nobody home to hear the knock.

And then came the questions Wyndham wouldn't answer.

The company told TechCrunch its security teams had "found no evidence of unauthorized access." That sounds reassuring until you hear the next part: when asked whether Wyndham even had the means — server logs, for instance — to tell whether anyone had been in the database before Wiggins, the spokesperson would not say. Nor would they say how long the password had been sitting inside the customer app, or what the long-term fix would be.

"No evidence of unauthorized access" and "we can prove nobody got in" are two very different sentences. The first is what you say when nothing tripped an alarm. The second is what you say when you checked. Wyndham has only said the first — and declined to say whether the second is even possible.

For Wiggins, this was the second time in two weeks. Fourteen days earlier he found a near-identical hardcoded credential in Applebee's app. Same researcher, same flaw, same method — download the app, read the code, find the key. Two different billion-dollar brands, one shared blind spot.

That pattern is the real story. A hardcoded password isn't a freak accident. It's what happens when the check that would catch it — scanning shipped code for secrets — either doesn't exist or nobody runs it. One company making the mistake is a bug. Two in a fortnight, found by one person doing routine checks, says the mistake is common. And Wiggins is one researcher. The apps he hasn't looked at yet are still on your phone.

So what do you do with this — as a learner, or just someone who books hotels?

If you use Wyndham's app, treat the next few weeks with suspicion: phishing emails that know your name, your email address and your member number will look very convincing, because the attackers can now make them look exactly like that. Wyndham has not said it will notify affected customers, and it has not said whether it will report the incident to regulators — TechCrunch asked and got no answer.

And if you're the one building the app: secrets do not belong in client-side code, ever. Passwords and keys live on the server, behind authentication, short-lived and rotated. Your build pipeline should scan every release for them automatically, because the person who finds them next might not be a good-faith researcher who calls a journalist — they might just walk in quietly, and if your logging can't tell the difference, you'll be the one saying "no evidence of unauthorized access" and hoping that's enough.

The password is revoked now. The door is shut. But nobody can say who walked through it while it stood open, or for how long. That's the part worth remembering the next time someone tells you a breach was found "with no evidence of unauthorized access."

Ask what they checked. Then ask what they can check.

Sources: TechCrunch, "Hotel giant Wyndham exposed customer data after app security lapse" (Zack Whittaker, 9 Nov 2026, updated 10 Nov 2026); corroborated by Tech Weekly's report of the same disclosure (10 Nov 2026). Wyndham's statements are as reported by TechCrunch. The number of affected customers is unconfirmed — "millions of entries" per the researcher; 129 million is Wyndham's stated rewards membership, not a breach count.