In short: AppSec Solutions audited 89 of the most-downloaded Russian food and grocery delivery apps using the Appsec.Sting platform and found 3,585 vulnerabilities — 1,290 of them critical. Every single app in the test had DNS vulnerabilities. Most exposed API keys and credentials directly in app code, readable by anyone with a decompiler. Your delivery history reveals far more about you than you might expect.
How the study was conducted
AppSec Solutions selected 89 of the most popular Russian apps in the food and grocery delivery category — from restaurant chain apps to express grocery services. The methodology was black-box testing: apps were downloaded from public sources (App Store, Google Play) and automatically checked against 74 vulnerability types, with no access to source code.
Black-box testing closely mirrors what a real attacker would do — they also start without source code, using the same tools available to anyone who downloaded the app from a store. Results were published on September 7, 2026. For a broader look at how mobile threats are identified, see our privacy and security blog.
The numbers: what was found
Across 89 apps, researchers found 3,585 vulnerabilities, broken down by severity:
- Critical — 1,290 (36% of all findings)
- High — 370
- Medium — 499
- Low — 211
On average, each app carries about 40 vulnerabilities, 18–19 of which need priority fixes. The delivery sector ranked 5th among all industries studied for the combined count of critical and high vulnerabilities (1,660) — behind only streaming services, finance, corporate applications, and media.
Nikita Pinaev, product lead at Appsec.Sting, noted that the risk profile of data held by delivery services is systematically underestimated: companies don't classify themselves as sensitive industries, yet they store information that enables detailed user profiling.
The top critical flaw: secrets hardcoded in app code
The most common critical vulnerability is sensitive data stored directly in the mobile app's compiled code. This includes API keys for cloud services (AWS, Firebase, Yandex Cloud), database credentials, and access tokens for third-party integrations.
The problem: decompiling an Android APK or iOS IPA is something anyone can do with freely available tools in a matter of minutes. Developers leave secrets in code for convenience or by oversight — and attackers extract them to gain unauthorized access to the app's cloud infrastructure. For an ordinary user, this means account data can be compromised without any interaction with a phishing site.
What that gives an attacker: the ability to create fraudulent accounts, redeem promotional codes at scale, read other users' order data, or — in the worst case — access the entire customer database.
DNS vulnerabilities: found in all 89 apps
One finding stands out: DNS vulnerabilities were present in every single one of the 89 apps tested. DNS is the internet's phone book — the service that translates a website address into a server IP. Vulnerabilities in DNS handling open the door to man-in-the-middle (MITM) attacks, where an attacker intercepts DNS responses and redirects app traffic to a malicious server.
In practice, this is especially dangerous on unprotected networks: public Wi-Fi in a café, shopping center, or airport. Without protection, a delivery app's requests can be intercepted and redirected. To understand how network-level protection works, see the LiMP VPN features page.
Your order data reveals more than you think
Researchers emphasize that delivery service data creates a comprehensive behavioral profile. Your delivery address shows where you live and work. Order timing reveals your daily schedule. Order contents indicate your approximate income level, food preferences, family composition — children, elderly relatives — and indirect health indicators.
Combined, this is far more valuable than just order data. Such a profile is of interest not only to advertisers but also to criminals who use it for targeted fraud and social engineering: knowing your schedule, address, and habits, attackers can convincingly pose as a courier or customer support agent.
How to protect your data
Keep apps updated. Developers patch vulnerabilities in new versions. Enable auto-updates in App Store and Google Play — this is the simplest way to ensure you have the most secure version available.
Review app permissions. Check what access your delivery apps have: location should be set to "while using only," and microphone access is rarely needed at all. Revoke unnecessary permissions in your iOS or Android settings.
Encrypt your traffic on public networks. DNS vulnerabilities are especially dangerous on open Wi-Fi: without protection, an app's requests are visible to everyone on the network. LiMP VPN encrypts all device traffic, including DNS queries, and prevents network-level MITM attacks — precisely the vector identified across all 89 apps. Note: a VPN secures the network layer but does not fix vulnerabilities inside the app code itself — that remains the developer's responsibility.
Use guest checkout where available. If a service offers ordering without registration, use it for one-time purchases. Less stored data means less exposure in the event of a breach.
Watch for suspicious activity. If you notice charges for orders you didn't place or login alerts from unfamiliar devices, change your password and revoke all active sessions immediately.
Sources
- 3,585 Vulnerabilities Found in Food Delivery Apps — CNews, September 7, 2026
- More than 3,500 Vulnerabilities in 89 Food Delivery Apps — ComNews, September 7, 2026