PuffPal, an App for Accessing Cannabis Clubs, Leaked 1 Million Users’ Passports
PuffPal, an app used by Spanish cannabis clubs for age verification, leaked over one million users' passport photos and personal data due to weak security. A researcher found hardcoded API keys and publicly accessible image URLs. The breach exposed celebrities and international visitors, highlighting risks of using high-value credentials in low-security systems.
Background
- **Nefos** runs PuffPal, an app used by Spanish cannabis clubs for membership check-ins, age verification, and consumption tracking.
- Spain's cannabis clubs are private member associations operating in a legal gray area; joining requires uploading a photo ID (passport or driver's license).
- **Sammy Azdoufal**, a security researcher, decompiled the PuffPal app and found passport scans, addresses, phone numbers, and consumption data stored at trivially guessable public URLs with no authentication. The app also had a plain-text Stripe payments API key.
- About 1 million people's records were exposed, including 30,000 from the US and various celebrities.
- **Bruce Schneier** (noted security expert) points out a key lesson: high-value credentials (passports) were used for a low-value system (cannabis club ID checks), and the low-value system's leak now puts the high-value credentials at risk — a pattern that matters as lawmakers push for broad age-verification mandates online.