I once found and disclosed similar issues in an app.<p>The app didn't use HTTPS so it was trivial to intercept Bearer tokens.<p>For some reason, most API endpoints returned way more data than necessary (e.g., when receiving a message you also get the user's last location, their name, their latest known profile icon), so simply observing network traffic on an Insecure WiFi network would be enough to get all the information you could ever want (no need to actually use that Bearer token).<p>And of course the app collected the precise GPS location and would return a GPS location with full precision in virtually every API response (messaging a stranger, fetching their public profile, etc).<p>In my private, responsible disclosure sent to the creator I demonstrated how I could use their private API to track the creator everywhere he goes. I think that drove the message home ;)<p>I am always skeptical when an app wants my GPS location.<p>Since I am friends with the creator's wife, I never wrote a post about this.