Why not just give the app away and let people access the content without having them sign up? Oh right… The people are the product.
As it often is, the source has more information, and significantly so. I also find it much easier and more informative to read. Simple direct speech, headlines, more concrete on what is exposed, more technical details, etc.
They didn’t just send one email to report the vulnerability.
and on January 3rd I emailed nine people: the general info address, six individual staff members at clicktopray.org, and two contacts at popesprayer.va (the Pope’s Worldwide Prayer Network). No response. From any of them.
For July they have three entries of ‘reported to Journalist’ (“Dark Reading”), journalist contacted the Pope’s Worldwide Prayer Network, and ‘still no response’.
They also posted an update about it being fixed on 2026-07-24 that it has been fixed.
The authorization check is there now: request your own user ID and you still get your email back, request someone else’s and you get a public profile. Names are supposed to be public on a platform where you pray alongside other people, so what’s left is what was always meant to be visible.
I also never got an email. Not an acknowledgment, not a thank you, not a “we’ve addressed this.”
Given that The Register posted this article on 2026-07-24 22 UTC it must have been very unfortunate timing. Presumably they didn’t check the source again before pressing publish? And also haven’t noticed or bothered to include an information update.
“Pope sprayer .va” is how I’m choosing to read that.
“We are gathered here today because your thoughts and prayers did not secure our app”
Why does it need any personal details at all??
So that jesus can torture the bad persons.
I expect they’re using some kind of authentication framework that supports full names in its User entity, and just went with that without considering whether it’s sensible.
Looks like you can leave comments on prayers? Could also be that they want a particular aesthetic where everyone has their innate “Christian Name”, instead of a username, which is assocated with left wing ideas like digital utopianism. Because…
Real names also enforce a complex of related authoritarian information structures i.e. they provide information about a person’s culture, race, gender, which you can use to assign them a place within your religion’s moral hierarchy.
So they know what sins I’ve committed.
They don’t follow my mastodon feed. It’s much easier that way.
They need the list of who’s been naughty and who’s been nice.
Or is that the other fella?
For sharing between users, as I understand it.
Username, password is all they need for that. Idiots.
But muh statistics :c
I have 100% attendance god damnit!
Historically? Abuse.
I’m sure they say it’s for security : blocking bots, etc and getting their newsletter or some shit.
There’s a fucking official app for prayers?!
The Catholic Church is known for a lot of things. Keeping up with the times (or cyber security) isn’t one of them.
Cyber security isn’t in the bible. Time for an update.
Cyprus 1:1
…. Copy pasta of NIST security standards circa May 2026 …
Nothing could go wrong with this.
I thought they were known for keeping things under the rug/hidden. Only priest’s not follower’s personal data I guess.
Vatican Programmer: Oh, mighty Lord, sitting in the Sky, show me the way to this bug I seek and eliminate ineffectiveness. Amen.
Still better than vibe coding
How so? They are praying for it to work
Well, i pray to not have any runtime bug too
The OG vibecoders
Apply the sacred unguents and start the maintenance rites
Vatican Programmer: Contractor in India
So uh… what does a prayer app even do?
It leaks personal data.
It connects users across the globe to pray for the Holy Father’s intentions, and as of July 2026, it has 719,517 registered accounts
The only two screenshots they have on GPlay feature prayer scheduling and sharing your prayer.
Damn, with that many people praying these prayers are about to get real effective. I’m surprised we haven’t heard of their effects and effectiveness yet.
See, humans are smart. Praying and blessing things yourself? By hand, so to speak? Boooo! Pedestrian! Ain’t nobody got time fo dat!
the Tibetans believe the prayers and mantras will be blown by the wind to spread the good will and compassion into all pervading space. Therefore, prayer flags are thought to bring benefit to all.
By hanging flags in high places the Lung ta will carry the blessings depicted on the flags to all beings. As wind passes over the surface of the flags, which are sensitive to the slightest movement of the wind, the air is purified and sanctified by the mantras.
I choose to believe that the prayer app is just a hip, new and with it innovation in prayer spreading.
It still works lmao
No email and some other stuff though… maybe they just removed that from the endpoint?
From the source blog post, which has the update
The authorization check is there now: request your own user ID and you still get your email back, request someone else’s and you get a public profile. Names are supposed to be public on a platform where you pray alongside other people, so what’s left is what was always meant to be visible.
lmao did they vibe patch it or smth
If sinners go to hell, do you even have to do due diligence? Let us pray for the vulnerability to disappear.
Why should they care about security user data? We’re all equal before God.
Misread it as
Pope’s official prayer app, “Cardinal Sin”…
That’s the official Catholic hook up app. It’s different.
Actually….
I thought that was Roblox?
Was this vibe coded?
That would be rather ironic.
a pope app? perfect for indulgence micro transactions
I think they patched that one a while ago
I’ve seen so many stories about leaks that I skip most of them. I’m glad I didn’t skip this one.
To borrow a tenet from another abrahamic religion, trust in God, but tie up your camel.
