Frustrated by an unavoidable algorithmic feed required to enter the facility, a member analyzed the gym's Flutter-based mobile platform. Offline testing confirmed that the dynamic, 15-second check-in QR codes were generated entirely on the device rather than via live server requests. By inspecting local application logs on a rooted phone, the user extracted plain text cryptographic data and constructed an independent web client to produce valid turnstile entry codes.
Key points
Reverse-engineering tools and artificial intelligence models enabled the user to fully re…: Reverse-engineering tools and artificial intelligence models enabled the user to fully replicate the facility's access tokens.
Storing plain text request and response payloads in device logs exposed the application's…: Storing plain text request and response payloads in device logs exposed the application's cryptographic keys to extraction.
The user built an independent SvelteKit web application to generate entry codes without u…: The user built an independent SvelteKit web application to generate entry codes without using the official platform.
Sources checked by our analysis pipeline: 1
My gym forced a social media down my throat. I reverse-engineered its app.
I recently joined a new gym. It’s a pretty good gym, with nice equipment, nice management, nice branding.
And an app.
Now, it’s not some random shitty vibe-coded app. It’s actually pretty good as a product. It has pretty slick UI/UX and a well-thought-out, consistent design language. I found only one bug in it.
For me, though, the only use case is to show a QR code at the turnstile for checking in and out.
However, there is a problem. The home screen of the app is a social feed. Once you check out, it prompts you to post a story of your session. The home feed is full of people’s gym selfies. Every time I open the app, I’m forced to see something that essentially looks like Tinder.
Now, my friend thinks this is a genius business idea. According to her, people who work out really want to flaunt their bodies, but posting that on normal social media is frowned upon. So this gym company really…
Federal intelligence and cybersecurity agencies are sounding the alarm after adversaries breached internet-linked temperature control systems vital to food distribution, transportation, and medical supplies. Attackers aim to manipulate cooling cycles to ruin perishable inventories, trigger physical fire hazards, and prematurely degrade expensive equipment. The widespread operational disruptions have already compromised critical infrastructure sites across multiple countries, raising significant national security c…
Conservation charity Polar Bears International developed an early-warning system that adapts smart security technology and short-range radar to prevent surprise wildlife encounters. Sea ice loss around Hudson Bay now forces polar bears to spend several extra weeks on land, driving the need for affordable deterrents near human settlements. The initiative aims to safeguard vulnerable northern communities as climate change increases the frequency of human-bear interactions.
Digital storefronts are expanding their retro catalogs through a major multi-platform release across Steam, GOG, and the EA App. The initiative makes dozens of legacy titles playable on modern operating systems while reviving decades-old franchise media. Players gain access to restored visuals and improved compatibility controls for long-dormant PC properties.