Dev finds wide-open auth flaw hours before solo app launch, fixes it overnight

A solo developer discovered a critical authentication vulnerability in his app's server just hours before submitting it to the App Store for review. During early development, he had added a shortcut allowing anyone to impersonate any user by passing a query parameter, with no token required. Days later, he prompted his AI coding assistant to review the server from a security perspective, and it flagged that all user data — meals, workouts, body metrics — was fully exposed without authentication. He patched the flaw overnight on June 28, enforcing token-based auth and server-side ownership checks across all endpoints before submitting at 23:04 that night. He noted the app had only one user at the time, crediting luck rather than skill for preventing any real data breach.