While reporting this story, 404 Media discovered that Tea’s data about the affiliate program, including who signed up for it, their real name, how much they have been paid, their emails, phone numbers, Venmo accounts, and charities they wanted to donate to if they didn’t want the money, were left exposed online. All a hacker or other third party had to do to view all of this data was add “/admin” to the public Tea affiliate site’s URL. Tea turned off this site and the affiliate program entirely after 404 Media reached out for comment for this article on August 13.

Vibe coding would have been better somehow.