[█████████] Hardcoded credentials in Android App

Summary

Authorization credentials for one of our development environments were hard coded in our Android App. We changed it as soon as this was reported.

Thanks @gerben_javado for reporting this.

After decompiling the Zomato app I found basic HTTP credentials in the app. This sort of happend on accident since I was looking for new endpoints to the API instead of looking for credentials. After finding the credentials I didn't know what do with them since the domain they belonged to returned a 503 error. Doing a subdomain bruteforce however discovered a subdomain where the credentials would expose a clone of the main admin panel.

Zomato shutdown this domain 5 minutes after I logged in.