Hi, The founder is Parth anand, who claims to be a researcher at MIT, which is very surprising given the lack of technical depth he possesses. I just found out that there's been a data breach on Project Sadak, a porthole reporting platform. The Firebase rules were not in place, and the user data was not secure. I was able to get the entire transcript of reports, as well as the data, and have...
best
the data currently sitting in the database is fully accessible to any third party and includes GPS coordinates, photo evidence, device identifiers, and behavioral records tied to every submission. Citizens are submitting under the belief that their data is protected and anonymous. It is neither right now.
This is also a potential breach of India's Digital Personal Data Protection Act, 2023 (DPDPA), as user-submitted location and photographic data is being stored without adequate technical safeguards.
I have a complete technical report documenting everything. I have not modified or exfiltrated any real user data. I'm reaching out before this goes any further. i am also asking for a public disclosure of the breach to the platforms users
Project Sadak (projectsadak.in) has been hacked.The entire public report layer was deleted. Every pothole report appears to be goneThe founder is yet to reply. He also claims to conduct research at MIT, which makes this Firestore security failure especially painful to watch.