Bootlegger, a South African coffee franchise, took an internal operations dashboard offline on 15 October 2026 after MyBroadband verified that store and franchisee data was readable by anyone who had the URL. The app showed a login screen. The data was already in the page.
What happened
An anonymous post on the MyBroadband forums and on Reddit said staff photos on Instagram showed the dashboard URL. People who opened the page found that the login screen was shipped with a large data payload in the page source. MyBroadband checked that payload and confirmed names and contact details linked to 132 Bootlegger locations, plus some performance and financial data.
The dashboard had been hosted on Railway. MyBroadband reported that the CEO, Ricky Ruthenberg, or his team, had built it with Claude, an AI coding assistant. Ruthenberg had posted on LinkedIn on 1 July 2026 about vibe-coding internal tools and mandating Claude for the 15 people who report to him.
After MyBroadband asked for comment, the Railway app was taken down. On the afternoon of 15 October, Ruthenberg said Bootlegger had learned of a potential data concern in a legacy version of BOS, an internal dashboard previously used for cafe support scheduling, trade reporting, store visit reports, and action items. He said historical data on that legacy platform had not been fully decommissioned, and that an initial review found some of it was not protected by the login. He named business performance data, cafe pipeline information, Google listing details, and business contact information, including franchisee and operator names and email addresses, and general manager names and mobile numbers.
Who is affected
This is not a vulnerability in a product you patch. It is a custom app, built quickly with an AI assistant, left on a public host with data embedded in the login response.
- Bootlegger franchisees and operators whose names and email addresses were in the payload.
- General managers whose names and mobile numbers were in the payload.
- Anyone who can be reached with a message that quotes a real store, a real manager, and a real mobile number.
- Any other South African SME that has put an AI-built internal tool on a public host such as Railway, Replit, or a similar platform without an access review.
What to do now
If you or a client built an internal tool with an AI assistant and hosted it on a public URL, open the page source of the login screen today and read what the server sends before anyone authenticates.
- Assume a login page is not a control. If the JSON, HTML, or a script tag already contains customer, staff, or store records, the data is public to anyone with the link.
- Take the app offline before you discuss it. Bootlegger's copy stayed up until a journalist asked.
- Inventory AI-built tools the same way you inventory SaaS: who hosts it, what data it holds, whether the URL is guessable, and whether it was meant to be retired.
- If franchisee, staff, or customer contact data was in an unauthenticated response, treat it as a POPIA security compromise and notify the Information Regulator and the people affected. Do not wait for a journalist to verify the count.
What this means for South African businesses
Most of the SMEs MiTSS supports do not run a pathology lab. A growing number of them do have an owner or an operations manager who has spent a weekend in Claude or a similar assistant and shipped the result to a public host because it worked. That is the pattern here, and it does not need an exploit.
A login screen that still returns the database is worse than a missing password, because the owner thinks the app is closed. The practical risk for a 100-store franchise, or a 10-person client with the same habit, is the same: real names and mobile numbers in a page anyone can save, then used the next morning in a WhatsApp that only a colleague would normally send.
Source: MyBroadband, Bootlegger CEO responds after vibe-coded app exposed data.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.