when your (likely vibecoded) privacy service leaks everything

An Unexpected Privacy Leak: When a Privacy Service Reveals More Than It Hides

Warning: This article discusses sensitive topics related to child abuse material (CSA). Reader discretion is advised.

---

Recently, I embarked on a routine investigation into a problematic Mastodon instance suspected of hosting harmful content. My goal was to identify the operators, their infrastructure, and whether there’s a way to report them. During my typical reconnaissance—WHOIS lookups, DNS checks, inspecting Impressums—I stumbled upon something alarming: a severe data leak through an ostensibly privacy-focused service.

The Unexpected Discovery

One of the common ways to protect anonymity in German websites is by using Impressum services—third-party providers that allow individuals to display a proxy address instead of their true home address, complying with legal requirements. The site I examined used a service called [site].de for this purpose.

Curiosity led me to view the page source, a habit many web researchers employ to uncover hidden metadata or data leaks. To my astonishment, I encountered the entire database record embedded directly into the HTML. This wasn’t just what was visible to users; it was every detail of user accounts—including sensitive and private information.

Here’s what I found in their HTML source:

json
{
"billingName": "Peter [REDACTED]",
"billingStreet": "[REDACTED]straße 14",
"billingZip": "2****",
"billingCity": "[REDACTED]",
"password": "$2b$12$s1a41lj7...",
"paypalCustomerId": "3BH**********"
}

This included users’ real home addresses, encrypted passwords, and PayPal transaction IDs—all exposed publicly and accessible by anyone inspecting the page source. Astonishingly, these data points belonged to multiple users, all of whom trusted this service to maintain their privacy.

Their homepage claimed “over 1,000 creators trust us,” but if true, it means a vast number of users had their sensitive addresses and personal data sitting exposed in clear HTML.

---

How Was This Possible?

The technical culprit was a Next.js-based web application. For the uninitiated, Next.js is a popular React framework that supports server-side rendering (SSR). While SSR is a powerful feature—making web pages fast and SEO-friendly—it can also lead to serious privacy issues if data isn’t carefully managed.

**What likely happened