"We are gathered here today because your thoughts and prayers did not secure our app"

Why does it need any personal details at all??

the API endpoint GET [redacted] will return user data for any account - not just your own account - so long as you supply a valid, five-digit user ID. It doesn’t perform any authorization check or ownership validation. “Just increment the number and get someone else's data,” she wrote.

This data includes users’ email addresses, first and last names, country, dates of birth, and whether the account has been deleted, and the API exposes all 719,517 accounts on the prayer site. “With sequential user IDs and no rate limiting, an attacker could enumerate every single account on the platform,” the hacker explained. “One GET request per user. for i in range(1, 719518): scrape(). That's it. That's the exploit.”

My God, that's horrific. Plus it doesn't even delete your data if you delete your account, it's still vulnerable.

The Catholic Church is known for a lot of things. Keeping up with the times (or cyber security) isn't one of them.

Vatican Programmer: Oh, mighty Lord, sitting in the Sky, show me the way to this bug I seek and eliminate ineffectiveness. Amen.

So uh.. what does a prayer app even do?

It still works lmao

No email and some other stuff though.... maybe they just removed that from the endpoint?

As it often is, the source has more information, and significantly so. I also find it much easier and more informative to read. Simple direct speech, headlines, more concrete on what is exposed, more technical details, etc.

They didn't just send one email to report the vulnerability.

and on January 3rd I emailed nine people: the general info address, six individual staff members at clicktopray.org, and two contacts at popesprayer.va (the Pope's Worldwide Prayer Network). No response. From any of them.

For July they have three entries of 'reported to Journalist' ("Dark Reading"), journalist contacted the Pope's Worldwide Prayer Network, and 'still no response'.

They also posted an update about it being fixed on 2026-07-24 that it has been fixed.

The authorization check is there now: request your own user ID and you still get your email back, request someone else's and you get a public profile. Names are supposed to be public on a platform where you pray alongside other people, so what's left is what was always meant to be visible.

I also never got an email. Not an acknowledgment, not a thank you, not a "we've addressed this."

Given that The Register posted this article on 2026-07-24 22 UTC it must have been very unfortunate timing. Presumably they didn't check the source again before pressing publish? And also haven't noticed or bothered to include an information update.

Misread it as

Pope's official prayer app, "Cardinal Sin"...

Why not just give the app away and let people access the content without having them sign up? Oh right.... The people are the product.

a pope app? perfect for indulgence micro transactions

There's a fucking official app for prayers?!

Was this vibe coded?

That would be rather ironic.

To borrow a tenet from another abrahamic religion, trust in God, but tie up your camel.

Is JD Vance in here? He's supposed to be Catholic right?

Why should they care about security user data? We’re all equal before God.