By Aras Nazarovas
Apps designed to protect our peace of mind are increasingly becoming sources of anxiety. Take 7 Minute Chi – Meditate & Move, a meditation app marketed to reduce stress, and Robo Spam Text & Call Blocker, an iOS tool meant to shield users from robocalls and phishing. Both promised safety – one for mental well-being, the other for digital security. Instead, they exposed sensitive user data through security failures, revealing a worrying truth: the apps we trust to guard our privacy are often the weakest links in our digital lives.
The Irony of Leaky Safe Spaces
The 7 Minute Chi breach laid bare the personal details of over 100,000 users-names, emails, and app secrets like API keys and Facebook credentials – due to a misconfigured Firebase database. This is a betrayal. Users sought calm and focus, only to have their data potentially weaponized for phishing or identity theft.
Also, Robo Spam Text & Call Blocker, downloaded 93,000 times, leaked 339,000 reported spam numbers, customer support tickets with real names and emails, and critical app secrets. Criminals now know which numbers users block and which keywords to avoid, and this enables them to craft scams that slip past filters.
These leaks aren’t accidents but symptoms of systemic negligence. Firebase misconfigurations, which leave databases publicly accessible, and hardcoded secrets embedded in app code are shockingly common. Our research shows 71% of 156,080 sampled iOS apps leak at least one secret, with an average of 5.2 per app. When developers cut corners, apps designed to protect become tools for exploitation.
The Human Cost of Broken Promises
For users, the fallout is deeply personal. Just imagine receiving a phishing email that references your meditation habits, perhaps even mentioning the specific app you use or the routines you follow – details you thought were private.
Or picture answering a spam call that not only gets past your trusted blocker, but uses language and tactics tailored to your reported preferences and blocked keywords, making the scam far more convincing.
In both cases, the sense of violation is profound: information you shared in the pursuit of calm or safety is now being used to target and manipulate you, turning trusted digital spaces into sources of new anxiety.
A Failure of Accountability
Neither Apple’s App Store reviews nor developer due diligence prevented these breaches. 7 Minute Chi’s Firebase instance sat exposed for weeks, while Robo Spam Text & Call Blocker’s parent company, Brantley Media Group, has a history of leaks, including an AI app that exposed users’ intimate stories. Yet, Apple’s ecosystem, often perceived as a “walled garden,” lacks mechanisms to scan for hardcoded secrets or enforce secure cloud configurations.
What’s Next?
To restore trust, the industry must prioritize:
- Expand app store reviews to include backend security checks: Apple and other platform owners should incorporate automated scans for misconfigured databases, hardcoded credentials, and other backend vulnerabilities before approving apps.
- Developers must follow secure coding standards, conduct regular code reviews, and leverage automated security testing tools to catch vulnerabilities early.
- Provide real-time privacy visualizations and alerts: empower users with dashboards or notifications that reveal how their data is used, and immediately alert them to potential leaks or suspicious activity.
- Offer post-breach support and transparency, and quickly notify users in the event of a breach, provide guidance on protective actions, as well as offer services such as personal data scans to help users recover.
- Regularly update and patch apps
As the lead researcher on these investigations, I urge users to demand better. Change passwords exposed in breaches, limit data shared with apps, vet apps before installing them, as much as you can, and pressure platforms to enforce stricter standards. Until then, the very tools marketed to protect us will continue to leave us exposed.
ABOUT THE EXPERT
Aras Nazarovas is an Information Security Researcher at Cybernews, a research-driven online publication. Aras specializes in cybersecurity and threat analysis. He investigates online services, malicious campaigns, and hardware security while compiling data on the most prevalent cybersecurity threats. Aras along with the Cybernews research team have uncovered significant online privacy and security issues impacting organizations and platforms such as NASA, Google Play, App Store, and PayPal. The Cybernews research team conducts over 7,000 investigations and publishes more than 600 studies annually, helping consumers and businesses better understand and mitigate data security risks.
TELUS marks 20th anniversary of TELUS Days of Giving
Posted in Commentary with tags Telus on May 1, 2025 by itnerdToday, TELUS announced its 20th annual TELUS Days of Giving kicks off on May 1, uniting TELUS team members, retirees, and partners around the world to volunteer and give back in their local communities. Throughout the month of May, TELUS team members, retirees, families, and partners around the world will participate in thousands of volunteer activities for TELUS Days of Giving. This global movement, which began as a single day of service two decades ago, now encompasses a diverse range of initiatives including environmental cleanups, food bank support, youth mentorship, and technology-focused efforts like device recycling. TELUS Days of Giving not only addresses immediate community needs but also fosters a year-round culture of volunteerism. This signature program runs from May 1-31 and last year alone, 83,000 volunteers gave back in 33 countries, contributing to 1.5 million volunteer hours in 2024, for the second consecutive year, more than any other company in the world.
With recent studies highlighting that one in five Canadians now rely on charitable services to meet essential needs, and more than half of charities unable to keep pace with current demand, TELUS’ longstanding commitment to giving back has never been more vital.
To learn more about TELUS’ commitment to creating positive change in communities where team members live, work, and serve, and to join in building a friendlier future for all, visit telus.com/purpose.
Leave a comment »