Bootlegger's CEO said AI will make software free. Then the company's own app leaked data on 132 stores

Bootlegger, the Cape Town coffee chain, had an internal web dashboard that asked staff to log in. The login made no difference. The company's data was already sitting in the page, readable by anyone who had the link.

MyBroadband reported on 16 October that the dashboard exposed names and contact information linked to 132 Bootlegger locations, plus some performance and financial data. The app was taken down after MyBroadband asked the company about it.

The way it was found is the part people cannot stop talking about. Bootlegger staff posted photos of their laptop screens on Instagram. The dashboard's web address was visible in those photos. Somebody typed it in.

How did Instagram photos give the dashboard away?

The leak first surfaced on the MyBroadband forum on 9 October. An anonymous poster wrote that current Bootlegger employees had been sharing pictures of their work screens, with the site showing in the shots.

Curious programmers then looked at the page behind the login. According to MyBroadband, the app sent a large amount of data to the browser together with the login screen. Nobody had to guess a password or break anything.

The forum poster went further. They said no hacking or login bypass was needed, and that Google had already found the site by July. MyBroadband did not repeat that timing, so it remains the poster's claim.

Late on 16 October the story spread around the world online. One post about it passed 270,000 views in less than a day.

The timeline so far, from the CEO's post to the takedown.

Photo: Husskeyy / Wikimedia Commons, CC BY-SA 4.0

What is vibe coding, and did the Bootlegger boss do it?

Vibe coding means telling an AI chatbot in plain English what you want, and letting it write the computer code for you. You do not need to know how the code works.

MyBroadband says Ruthenberg "appears to have encouraged or directly developed" the dashboard using Claude, an AI assistant made by the company Anthropic. That is the publication's wording, and we use it exactly.

In his LinkedIn post of 1 July, as MyBroadband reports it, Ruthenberg said he had spent six weeks vibe coding every night and weekend. The next Monday he made Claude compulsory for his 15 direct reports, with "a proper AI adoption plan" behind it.

He wrote that he was blown away by what his team built in six weeks. He said people's lives had changed, and that Bootlegger's operations would never be the same.

Read nextLedger wallets drained? The claim, the past incidents and what is confirmed

Neither Ruthenberg nor Bootlegger answered MyBroadband's questions before it published.

How can a locked login screen still leak everything?

Every web page has a page source. It is the raw text your browser downloads before it draws the page, and anyone can see it by right-clicking and choosing "View page source".

A safe app only sends the data after you have logged in. This one, according to MyBroadband, sent the data down with the login page itself. The password box was there for show.

A neat login screen proves nothing on its own. The real test is where the data goes, and when. Gadgets do strange things with data too, like the smart coffee machine that moved 1TB in 10 days.

What did Bootlegger's dashboard leak?

MyBroadband says it confirmed two things.

• Names and contact details linked to 132 Bootlegger locations
• Some performance and financial data

Many Bootlegger stores are franchises, run by owners who bought the right to use the brand. That means the contact details belonged to real business owners and managers, not just head office.

We have not seen the data and will not repeat any of it. The app was hosted on a cloud service called Railway, and it went offline after MyBroadband's query.

Who is Bootlegger, and how big has it grown?

Bootlegger was started in Cape Town in 2012 by three cycling friends, Pieter Bloem and brothers De Waal and Antonie Basson. They wanted coffee before 6:30 in the morning and could not find any. They bought a small shop called Go Gos and rebuilt it around a 1920s America theme.

It grew fast. MyBroadband puts the growth from 2019 to September 2025 at 378%.

18.002019

86.00Sep 2025

100.00End 2025

2019	18.00
Sep 2025	86.00
End 2025	100.00

Source: MyBroadband, 16 October 2026. The leaked dashboard held contact details linked to 132 locations.

The chain opened its first store outside South Africa, in Windhoek, last year. It employs about 3,500 people. Big local brands live and die on trust, as the retailers pulling ahead while others bleed show.

Photo: Martin Vorel / Wikimedia Commons, CC BY-SA 4.0

What are people saying about the Bootlegger leak?

Reaction online split two ways. Many people laughed, calling it "security hole as a service" and joking that the boss had automated the leak from start to finish.

Trending nowPetrol broke R30 a litre. We followed the money

Others asked why a CEO was writing code at all, and saw a warning for every company rushing to put AI to work.

Will AI take programmers' jobs?

Many people now believe AI will make developers and other professionals redundant. The Bootlegger case points the other way.

The tools are remarkable. Someone with no coding background can describe an idea at night and have a working app by morning. Companies should want bosses who try that, and Ruthenberg's push to get his managers using AI is the kind of move many firms are still too slow to make.

What the AI did not supply was the judgement of someone who builds and secures systems for a living. The login screen looked finished. According to MyBroadband, the data was already in the page source.

Vibe coding has cut the cost of building an app to almost nothing. It has not cut the cost of understanding security. Think of it like a car. Anyone can buy the tools, but few people would fix their own brakes or airbags themselves.

There is also a line between two kinds of app. A staff member vibe coding a small tool to save time is a good use of AI. An app wired live into the whole company's data, with franchisees' contact details and financial figures, needs the same care as any system the business depends on.

Software may get cheaper to write. Keeping it safe still takes people who know what to look for.

What should a business owner check before staff build their own apps?

Use the AI, then put proper checks around it. Before an app touches real customer or staff data, these cost almost nothing.

1. Ask one simple question. Does any data reach the screen before someone logs in? If a developer cannot answer, the app is not ready.
2. Get a second pair of eyes. Have someone who knows security test it. A few hours of an expert's time is cheaper than a leak.
3. Search for it yourself. Type the app's address into Google. Internal tools should not show up at all.
4. Keep it off the open internet. Put internal dashboards behind the company network, not on a public web address.
5. Mind the background. Tell staff not to post photos of work screens. That is how this one was found.

Bosses are pushing AI hard, as the developer told to manage 10 AI agents at once found. These checks take less time than one late-night coding session.

Where did he say the real value sits?

Ruthenberg's July post made a bold prediction. As MyBroadband reports it, he wrote that "AI has completely levelled that playing field", and that software "will soon become free, I am almost certain."

He also wrote where he thought the money would be from now on. "The value going forward sits in the data," he said, speaking about the software companies that hold their customers' information.

He may be right about the software. An app like this can now be built for almost nothing.

The data was another matter. It was the one thing he called valuable, and it was the one thing anyone with the link could read.