Imagine confessing your deepest secrets to a priest, only to find out the entire congregation got a transcript. That’s basically what happened to 700,000 users of the Pope’s official prayer app. You clicked to pray. You leaked your data.
Bob Diachenko, a security researcher, discovered the vulnerability in the Click to Pray app — an app blessed by the Vatican to help the faithful connect spiritually. Instead, it exposed user emails in plain sight, no authentication required. One click, and anyone could scrape the entire user list. When an app designed to bring you closer to God becomes a data leak, it’s not just a bug — it’s a betrayal of faith.
You’ve probably downloaded an app from your church, your bank, your doctor. You trust them. That’s the problem. Institutions that have earned your trust are the most dangerous vectors for security failures because nobody questions them. Trust is the vulnerability that never gets patched.
The knee-jerk reaction is to blame ‘vibe coding’ — the trend of using AI assistants to churn out code without rigorous review. But that’s a convenient scapegoat. The real sin is deeper. The Vatican outsourced its digital soul to developers who didn’t understand the sacred responsibility of handling user data. They treated a prayer app like a to-do list. You don’t need an AI to write insecure code — you just need someone who doesn’t care enough to test it.
Here’s the twist: the app’s purpose was to foster spiritual connection and trust. But trust in a digital product is a technical property, not a theological one. The same vulnerability that leaked emails could have leaked prayer intentions, donation histories, or even geolocation data. The Vatican got lucky. Most users won’t.
I’ve seen this pattern before. Non-tech organizations — churches, nonprofits, schools — rush to build apps because ‘everyone else is doing it.’ They hire cheap freelancers or use AI tools to generate code in hours. They skip security audits because ‘who would target us?’ The answer: everyone. Your faith in an institution’s good intentions doesn’t encrypt your data.
So what do you do? Stop trusting apps just because they come from a trusted name. Look at the permissions. Ask about security audits. And if an app from a religious organization asks for your email, think twice. The road to hell is paved with good intentions — and unsecured APIs.
FAQ
Q: Wait — wasn't this just a minor bug? How is it a big deal?
A: Exposing 700K email addresses isn't minor. Emails are the keys to the kingdom for phishing, account takeover, and targeted scams. Because the app was from the Vatican, users are far more likely to click a link in a 'prayer update' email — that's the perfect phishing vector.
Q: What's the practical takeaway for someone who uses apps like this?
A: Don't assume an app is secure just because it comes from a trusted institution. Treat every app like it could be compromised. Use a separate email for sign-ups, enable two-factor authentication where possible, and think twice before sharing personal data with any organization — even the Pope's.
Q: Isn't the real problem 'vibe coding' — AI-generated code?
A: Vibe coding is a scapegoat. The root cause is the lack of security culture in non-tech organizations. Whether code is written by AI or a human, the same mistakes happen when nobody tests for vulnerabilities. Blaming AI lets institutions off the hook for their own negligence.