_vghb

Yes, It's not 100% hacking, but I guess I exploited a vulnerability in their API by creating an administrator account to gain access to their dashboard.

Thanks for the comment, I will change the dashboard picture

There is a big dilemma about privacy in such contact tracing apps, solutions, that require a post of its own.

I mean, if you have no idea who access the data, who can use the data.

Yes anyone can put a TOS or privacy policy that no one can see the data, but even though that's the case, there have been numerous occasions where employees were found to misuse PII.

A simple cookie token or session token is all what it needed for a quick fix

Sorry about that, and thanks for the update :)

Yes, there should have been more pen testing and reviews before such an important service was released storing lot of personal information.

I'm happy I was able to find the vulnerability within 4 days of it's public release

OP here - Thank you very much.

Yes it was a simple debugging everything done with the browser and with some code review :)