Bedtime Bug Hunting: A Friendly Android Auth Bypass Story - Jeffrey Roe

One night, while lying in bed and idly poking around an Android app for a membership organisation I belong to, I found myself somewhere I did not expect to be: past the login flow. This lightning talk is a short, friendly story about curiosity, mobile apps, and responsible disclosure. It is not about shaming an organisation or showing off a live exploit. In fact, once the issue was reported, the organisation responded quickly and the app was patched soon after. That is the kind of outcome we should want to see more often. The talk will cover the discovery at a high level: what caught my attention, how I tested the behaviour safely, what the app appeared to trust, and why authentication and authorisation need to be enforced server-side rather than relying on client-side flows or assumptions. I will also talk about where I stopped, what I avoided doing, how I documented the finding, and how I approached reporting it constructively. The broader theme is the value of a playful security mindset. Many useful findings start with the simple question: “What happens if I press this?” Makers, engineers, testers, and defenders all benefit from gently poking at systems, noticing odd behaviour, and then handling what they find with care. Attendees will come away with a better sense of how mobile authentication flows can go wrong, what good responsible disclosure can look like, and why curiosity plus ethics is such a useful combination in security.