UPDATE: emailed the founder, which is completely legal since I didn't want the site to be further attacked. The founder shows reluctance to cooperate and has issued a notice on the site (firebase quota expired) to hide the vulnerability without fixing it

the data currently sitting in the database is fully accessible to any third party and includes GPS coordinates, photo evidence, device identifiers, and behavioral records tied to every submission. Citizens are submitting under the belief that their data is protected and anonymous. It is neither right now.

This is also a potential breach of India's Digital Personal Data Protection Act, 2023 (DPDPA), as user-submitted location and photographic data is being stored without adequate technical safeguards.

I have a complete technical report documenting everything. I have not modified or exfiltrated any real user data. I'm reaching out before this goes any further. i am also asking for a public disclosure of the breach to the platforms users

I am an ethical hacker - who gets platforms secure before unauthorized access and attackers can make changes and affect the platform - I have no affiliation with any organization nor with Parth Anand. I will maintain updates in this thread on hacker news.

best

PROJECT SADAK IS BREACHED