App for outing Charlie Kirk’s critics leaked its users’ personal data
An app for anonymously reporting individuals accused of speaking ill against conservative activist Charlie Kirk leaked personal data about its users. The app, known as “Cancel the Hate,” was taken offline on Thursday amid an investigation into the data leak by Straight Arrow News.
Launched in the wake of Kirk’s assassination on Sept. 10, Cancel the Hate aims to “hold individuals accountable for their public words,” according to its website. It calls on users to “express concern” by submitting “intel” on alleged offenders, including their names, locations and employers.
Download the SAN app today to stay up-to-date with Unbiased. Straight Facts™.
Point phone camera here
Cancel the Hate highlights a particular interest in medical professionals, “whose conduct could endanger patients,” the website says, as well as public officials, business owners, entertainers, influencers, teachers and education administrators.
“We do not seek revenge or mob justice,” the website says. “Our goal is transparency — to ensure that individuals in positions of power cannot hide hateful words or actions from public scrutiny. They should NOT be harassed, threatened, or harmed in any way.”
The app is part of a broader effort among conservatives to punish those who have criticized Kirk or are seen as celebrating his shooting at a speaking event on a Utah college campus.
Cancel the Hate was founded by conservative activist Jason Sheppard, who is best known for selling fentanyl testing kits with comedian Roseanne Barr, vaccine skeptic Dr. Robert Malone and right-wing journalist Lara Logan. The website says all reports must “include verifiable information about the submitter.”
Users’ personal data exposedCancel the Hate says users who submit data on others will not have their own personal details made public. However, a social media-style app launched alongside the website appears to have been exposing just that.
The flaw in the app, discovered by the security researcher who identifies himself as “BobDaHacker,” enabled the exposure of user information such as email addresses and phone numbers. Although email addresses were included in profile bios by default, seemingly unbeknownst to many of the platform’s users, the data could still be exposed even if privacy settings were enabled to keep it hidden.
SAN reached out to Cancel the Hate over a contact form on its website to inquire about the vulnerabilities in the app but did not receive a reply.
The webpage hosting the app was taken offline several hours later, but not before SAN was able to obtain a copy and set up a test account.
BobDaHacker provided SAN with a sample of data from 142 users, including information from SAN’s test account. The hacker also demonstrated how the security flaw allowed them to remove users by deleting SAN’s test account. A message sent by SAN to the company that built Cancel the Hate’s website and app, DreamTeam Development, LLC, went unanswered.
SAN reached out to a user listed in the leaked data and confirmed that they had in fact downloaded the app. The user, who asked to remain anonymous over fears of retribution, expressed concerns that Cancel the Hate might be a “scam” after receiving an influx of donation requests to their email.
Start your day with fact-based news. ‘Folks that need to be outed’In a post on Facebook last week, Sheppard claimed that Cancel the Hate had received more than 38,000 reports in the first 30 hours after its launch. Sheppard also said the social media app could be used to “better organize and focus on outing the folks that need to be outed.”
Since then, Sheppard’s profiles on Facebook and X, as well as those belonging to Cancel the Hate, have been deleted without explanation. The deletions came after Sheppard was bombarded with complaints from critics of the website.
Sheppard did not respond to multiple emails and phone messages from SAN. Given that the vulnerabilities remain, SAN has declined to publish any further technical details.
Editor’s Note: A previous version of this article incorrectly listed the founders of the Cancel the Hate app.
contributed to this report.