The Tea app leak: 72,000 images exposed by a misconfigured storage bucket

In July 2025, the Tea app left a storage space open to the internet, exposing selfies and ID photos used to verify its users. No sophisticated attack was needed. Lessons for anyone building an app.

In late July 2025, users of the forum 4chan found that a storage space used by Tea, an app popular with women in the United States, was open to anyone. Inside were photos sent by users, including the selfies and ID documents used to verify their accounts.

What was exposed

• Tea confirmed about 72,000 images, including around 13,000 selfies and ID photos and 59,000 images from posts, comments and messages.
• According to the company, the files came from a legacy system and concerned users who signed up before February 2024.
• A few days later, a security researcher found a second problem: private messages that any logged-in user could reach through the app’s API.

Not a hack, a configuration error

The storage space was hosted on Firebase, a Google service whose storage is private by default. Someone had opened it to the public. No password was cracked: the files were simply reachable at their address. Several analysts also pointed to code written quickly without a proper security review.

Lessons for anyone building an app or a website

• Check access rules for every storage space and database before launch, then after every change.
• Delete verification documents once the check is done: an ID you no longer keep cannot leak.
• Test your app as an outsider would: can a file or an API be reached without the right account?
• Have code reviewed, including code generated by AI tools, before it goes into production.

Speed versus care

Launching fast is tempting. But when an app handles identity documents, one forgotten setting can expose thousands of people. Security has to be part of the launch checklist, not an extra for later.

The simplest leaks come from a door left open, not from a lock picked.

Sources: Tea’s official statement, CyberInsider, Simon Willison, teiss, July 2025.

Launching an app or a website that handles personal data? Tell us about your project through our estimate form: we will reply with an estimate and the next steps.