E84 - AI Drama | Brazil's Lesbian Dating App Disaster: AI Security Flaw

Brazil’s Lesbian Dating App Disaster: AI Security
Flaw

Listen now:


Spotify
https://open.spotify.com/episode/249ZA6nHHoKmaiGYqY6Jum?si=91mGWjWJT-ur14At1KWpjA&nd=1&dlsi=a9615ac3d72642d5


Apple Podcasts
https://podcasts.apple.com/at/podcast/brazils-lesbian-dating-app-disaster-ai-security-flaw/id1846704120?i=1000732455609
Description

Marina thought she finally found safety.


A lesbian dating app in Brazil — built by queer women, for queer
women.


Manual verification. No fake profiles. No men.


Then everything went wrong.


In September 2025, Sapphos launched as a
sanctuary with government-ID checks.


Within 48 hours, 40,000 women downloaded it.


A week later, a catastrophic flaw exposed the most sensitive data
of 17,000 users — IDs, photos, names, birthdays.


One researcher discovered he could view anyone’s profile just by
changing a number in a URL.


That’s how fast “safety” can vanish when speed beats
security.
What This Episode Covers

This episode of AI Drama investigates how AI-generated
code, underqualified devs, and “vibe coding” collided
with a vulnerable community.


It’s not a takedown of two activists — it’s a
warning about asking for extreme trust without
professional security.
You’ll Learn

How a single IDOR-style bug leaked
government IDs and photos

Why AI-generated code often ships with
hidden flaws

The unique threats LGBTQ+ apps face in
high-violence regions

What happened after the founders deleted
evidence of the breach

How to spot red flags before uploading your
ID anywhere

️ The Real Stakes

Brazil remains one of the most dangerous countries for LGBTQ+
people.


Lesbian and bisexual women face three times
higher rates of violence than straight women.


For many Sapphos users, being outed wasn’t embarrassing — it was
life-threatening.
What Went Wrong

Identity checks increased trust — but concentrated
risk

When one app collects IDs, selfies, and
locations, a single bug exposes everything


AI sped up insecure coding — ~45 % of
AI-generated code has vulnerabilities

No audits, no penetration tests, poor access control

Logs deleted evidence erased

Communication failed: instead of transparency, users saw
silence and denial

Red Flags Before Trusting an App

Verified security audits (SOC 2 / ISO 27001)


Transparent privacy policy + deletion options


Minimal data collection — no unnecessary IDs


Public security contact or bug-bounty page


Experienced, visible founding team


Avoid apps claiming “100 % secure” or “completely private”
️ Safer Habits

Use unique emails + a password manager


️ Prefer privacy-preserving verification methods


Turn off precise location & strip photo metadata


After any breach: change credentials, rotate IDs if
possible, monitor credit
Notable Quotes“Marina’s only ‘mistake’ was
trusting people who promised protection.”“The lesson isn’t don’t
build — it’s don’t build insecure. Demand proof, not
promises.”Select Facts

~45 % of AI-generated code shows security
flaws

LGBTQ+ users face more online harassment

Brazil records one LGBTQ+ person killed every ~48
hours



️ AI Drama is a narrative-journalism podcast
about the human cost when technology fails those who trust it
most.


Hosted by Malcolm Werchota.