A real case: why response speed to a security report reflects company culture

Recently my team ran a security research project on several popular dating apps using reverse engineering. The goal wasn't to cause harm, but to check how well real user data is protected in products used by millions of people daily.

Results varied a lot. Two apps showed no critical issues. The third one told a different story: unencrypted local storage of auth tokens, premium status verified client-side instead of server-side, and a few other issues that together open the door to abuse.

We sent a responsible disclosure report to the app's developers on the 17th, and published a detailed writeup here the same day.

Seven days of silence. Today, the 24th, we finally got a response, first a formal note that the report was forwarded to the technical team.

A bit later the same day, a second message arrived. The company thanked us for the work and confirmed that most of the reported vulnerabilities are already being addressed.

Good to see the report wasn't ignored and the issues were acknowledged. Still, seven days for an initial response to a security issue like this is too long.

Compare that to how we operate. When a bug or vulnerability report reaches our team, the response happens within hours: analysis, fix, surface-level testing, thorough testing, and a new build submitted to the store the same day.

The difference isn't about resources. It's about a culture of accountability.

Full technical breakdown is in a separate post from the 17th on my profile, for anyone curious about the details.