Bootlegger AI dashboard reportedly exposes franchise data

The vulnerability was highlighted by an anonymous user on online forums, who described how the application was discovered and how its security weakness was identified.

The incident follows Ruthenberg’s public advocacy of AI-assisted software development. In a LinkedIn post published on 1 July 2026, he described using Claude, Anthropic’s AI assistant, to build internal software over six weeks of evening and weekend work.

He subsequently introduced the tool to the 15 employees reporting directly to him and tasked them with developing a broader AI adoption plan.

Ruthenberg said the results had impressed him and would fundamentally change how Bootlegger operates.

Login screen failed to protect data

According to the online disclosure, the dashboard came to light after Bootlegger employees posted photographs of their laptop screens on Instagram, inadvertently revealing the application’s web address.

Although the website displayed a login screen, the application reportedly transmitted sensitive information to the browser before authentication. This meant that someone with the URL could potentially inspect the page’s source code to access the data.

The application was hosted on Railway, a platform for deploying web applications. It was taken offline after enquiries were made about the reported vulnerability.

The available information does not establish whether the data was accessed or misused beyond the discovery described in the disclosure.

The incident highlights a potential weakness in the growing use of vibe-coding, in which AI tools generate software from natural-language instructions, sometimes without developers fully reviewing the underlying code.

While such tools can reduce development time and costs, they do not remove the need for security testing, independent code reviews and appropriate access controls.

Rapid expansion increases the stakes

Bootlegger was founded in Cape Town in 2012 by Pieter Bloem and brothers De Waal and Antonie Basson. The business began after the founders identified a shortage of quality coffee shops open before 06:30 to serve their early-morning cycling routines.

They acquired a small outlet called Go Gos and later rebranded it as Bootlegger, drawing inspiration from the American Prohibition era.

The franchise grew from 18 locations in 2019 to 86 by September 2025, before reportedly reaching 100 stores later that year. It also opened its first international outlet in Windhoek, Namibia, in 2025.

The business operates a micro-roastery that processes about 400 tonnes of coffee annually and has a reported workforce of 3,500.

At this scale, the protection of franchise information is a material business concern. A compromised internal system can expose commercially sensitive information and personal contact details across a large operating network.

AI adoption brings governance challenges

Ruthenberg has argued that advances in large language models are weakening software vendors’ ability to lock customers into proprietary systems. In his view, value will increasingly reside in the data companies hold and the services they provide around it.

The reported dashboard exposure illustrates the tension between rapid AI adoption and the controls needed to manage its risks.

A functioning application is not necessarily a secure one. If sensitive information is delivered to a browser before a user’s identity and permissions are verified, a login screen offers little meaningful protection.

Businesses experimenting with AI-generated software need to ensure that security is built into the development process, with server-side authorisation, data minimisation and independent testing before deployment.

The broader lesson for companies embracing AI is that faster software development must be matched by adequate technical oversight and accountability for the systems they put into operatio