Security Concern – Third-Party Developer Requesting JSON/API Keys for Backend Access

Question

AduotAleuAyieny OP

Created 4d

Replies 3

Boosts 0

Participants 2

Hello Apple Developer Community,

I recently encountered a serious security issue involving a third-party app development company that requested full JSON API key access to my Apple Developer account. After conducting research, I realized that granting this access would allow permanent backend control over my app—even after our contract ended.

Key Issue: • Third-party developers extract JSON API keys from client accounts. • These keys allow unrestricted backend access, even after being removed from the account. • With this access, they can: • Modify apps remotely • Interfere with financial settings • Restrict client access while maintaining their own backend control

Why This Matters: • This could be happening at scale, affecting many developers unknowingly. • It’s a major security risk—developers could be losing control of their apps without realizing it. • Apple’s policies do not explicitly warn against this kind of practice, which leaves developers vulnerable.

I Need Guidance: • Is there an official Apple security team I can report this to? • How can developers safeguard themselves from these kinds of exploits? • Does Apple have a protocol for auditing third-party developer activity within client accounts?

I have full documented evidence of this practice, including chat logs, emails, and technical breakdowns.

This is a serious issue that needs the right eyes on it.

Please advise on the next steps Apple recommends for reporting and addressing this vulnerability.

Kindly find my evidence below.

https://drive.google.com/drive/folders/1uZnAvJE48OazvSgMYr6-wSB1Ss5rF5r4

Boost

Answer 1

AduotAleuAyieny OP

4d

How is it that no one is responding to this?

im ringing the alarm people.

Look 👀

https://drive.google.com/file/d/1t5_hNTXYp9svjScP5GK0tJMlMeJoSdJl/view?usp=drivesdk

👆🏿This is serious. Help me

0

Answer 2

endecotp OP

4d

What exactly do you imagine the ”four random people on the internet” who read this forum are going to do? We’re not law enforcement.

No I’m not going to click on your random googledrive link.

1

Answer 3

AduotAleuAyieny OP

3d

I get it. This platform isn’t law enforcement. But you don’t need a badge to recognize a security disaster when it’s staring you in the face.

I’m not asking you to fix it — I’m documenting proof of systemic abuse that affects every developer who handed over API keys in good faith.

The link contains full evidence, but since people are understandably cautious, I’ll summarize the findings here — no need to click.

This will likely be the last time anyone down here sees it before the real storm hits. But I won’t be the one caught unprepared.

0