TeaOnHer app, rival to the Tea safety app leaks driver's licenses and personal data of 53,000 users
Learn More
TeaOnHer, a newly launched application designed for men to share information about women they have allegedly dated is found to expose data of approximately 53,000 users.
The application, launched on Apple's App Store by Xavier Lampkin earlier in August 2025 as a direct response to the popular women-only Tea app. It has rapidly gained popularity despite its controversial nature. TeaOnHer achieved the number 2 ranking among lifestyle apps on iOS and reached number 17 across all free applications.
The security vulnerabilities in the app allow unauthorized access to personal information including:
- government-issued driver's licenses,
- verification selfies,
- private user communications
- Usernames and account display names
- Email addresses associated with user accounts
- Self-reported location information and geographic data
- Administrative credentials including plaintext passwords
The data exposure is caused by critical security vulnerabilities in TeaOnHer's application infrastructure that allow unauthorized individuals to access user information without authentication. TechCrunch security researchers discovered that the application contains at least one major security flaw enabling anyone with knowledge of the vulnerabilities to access user data through publicly accessible web addresses. The compromised data can be viewed using standard web browsers, making the personal information easily accessible to malicious actors who obtain the direct links to the exposed content.
TechCrunch investigators also identified a secondary security vulnerability involving the application creator's administrative credentials. Xavier Lampkin's email address and plaintext password were discovered exposed on the server, potentially granting unauthorized access to the application's administrative control panel.
Investigators observed troubling content within TeaOnHer's platform, including multiple instances of the same explicit images posted under different user names, potentially representing non-consensual sharing of intimate content. Additional posts contain derogatory comments about women and unsubstantiated allegations regarding sexually transmitted infections, highlighting the platform's potential for harassment and defamation.
TeaOnHer's development company, Newville Media Corporation, has not responded to multiple attempts by security researchers to report the vulnerabilities or provide official statements about the data exposure.
