Story perspectives

McDonald's Digital Security Flaws Exposed: No Reporting Channel

8/20/2025

26 4

Summary

Story summary

Security researcher BobDaHacker identified significant vulnerabilities in McDonald's digital systems, including flaws in the rewards app and Feel-Good Design Hub.
The absence of a security.txt file complicated vulnerability reporting, necessitating direct contact with McDonald's.
Inadequate OAuth implementation allowed crew members access to executive portals and sensitive employee data.
McDonald's has not established a security reporting channel or bug bounty program, leaving vulnerabilities unresolved.

1 of 1

Story summary

Security researcher BobDaHacker identified significant vulnerabilities in McDonald's digital systems, including flaws in the rewards app and Feel-Good Design Hub.
The absence of a security.txt file complicated vulnerability reporting, necessitating direct contact with McDonald's.
Inadequate OAuth implementation allowed crew members access to executive portals and sensitive employee data.
McDonald's has not established a security reporting channel or bug bounty program, leaving vulnerabilities unresolved.