>>511317913
>it's a public bucket
The app doxxed itself lmao

enjoy

afDevKey=WDD488TccmDWWkEpJPytfD
appleStoreId=6444453051
androidSegmentWriteKey=TVyzCf9S3cATwD8V3TimEBzIzhHVsLMc
iosSegmentWriteKey=dWM3U1jmBA07OZJ2JZZgO9aeSXivQxFG
sentryDsn="https://cc742df4957ce54acbf0d688da1f62a5@o4507273518383104.ingest.us.sentry.io/4507300875730944"
revenueCatGoogleKey="goog_bzJjOcIsIlbgPEPxqqyYFnHOpRO"
revenueCatAppleKey="appl_rsLNTxdGpbHpPbTNBwxKywXsVHU"
apiUrl="https://api.teatheapp.com"
# apiUrl="http://192.168.15.7:3333"
# socketUrl="https://hermes.teatheapp.com"
socketToken="bc125b256c35adf76ae4d2a1f8cdd189"
mapboxAccessToken='pk.eyJ1IjoidGVhZGV2IiwiYSI6ImNtNGg2eDR1ZzAxOTMyanBvYWhiMnd6b3IifQ.w0uY-e6SEkxdeFkd-NZySA'
taraId='46a32ac1-a20d-4130-805c-37c06ec781b8'
giphyApiKey='RHfKLfCpTB78MynBhv4bXdw3PcdhtNCv'

If anyone has a sister or girlfriend, try registering an account on the app using an Android emulator and capture the network traffic. It really doesn’t seem that hard to break or spam.

These endpoints work without any authentication:

https://api.teatheapp.com/locations?search=usa
https://api.teatheapp.com/users?search=chad

Also found:
/notifications
/posts

Looks like the API is pretty open.

If anyone has a sister or girlfriend, try registering an account on the app using an Android emulator and capture the network traffic. It really doesn’t seem that hard to break or spam.

These endpoints work without any authentication:

https://api.teatheapp.com/locations?search=usa
https://api.teatheapp.com/users?search=chad

Also found:
/notifications
/posts

Looks like the API is pretty open.