# The Vatican's Prayer App Has Been Blessing Hackers With 700,000 User Records Since January
The exposure isn't technically sophisticated. It doesn't require a toolkit, a VPN, or any special knowledge. You open a browser, type a URL, and the Pope's worldwide prayer network hands you names, email addresses, country locations, and account statuses for every person who ever signed up. All 700,000-plus of them.
That's been true since at least January, when a white hat researcher named BobDaHacker found it. Six months later, it's still true.
## A Vulnerability So Old It Has OWASP Frequent Flyer Miles
The flaw is an insecure direct object reference — IDOR — in the API backing Click to Pray, the Vatican's official mobile and web prayer app. The Pope's Worldwide Prayer Network runs it; a communications firm called La Machi built it. Between them, nobody implemented the most basic access control on a data endpoint.
Here's how it works: when you create a Click to Pray account, the system assigns you a sequential user ID. Sequential. As in, user 1, user 2, user 3. The exposed API endpoint accepts any user ID and returns the associated account data — name, email, country, whether the account belongs to a regular user or a staff member. No token. No session cookie. No authentication of any kind.
Dark Reading confirmed it independently and reported it still active at publication time Thursday.
IDOR has been on the OWASP Top 10 since OWASP has been publishing lists. Sequential IDs making it exploitable — that's a compounding failure, the kind that suggests the people who built this app either didn't have a security review or didn't have one that mattered. Randomized or non-guessable identifiers wouldn't make the authentication hole disappear, but they'd at least require some effort to enumerate. Right now, a script looping through integers from 1 to 700,000 is all it takes.
## Six Months and Nobody Fixed It
What's arguably worse than the vulnerability itself is what happened after it was found.
BobDaHacker discovered this in January. Dark Reading eventually got involved, attempting to pressure the Pope's Worldwide Prayer Network into a fix through responsible disclosure. That went nowhere. They then reached out to La Machi, the developer. No response.
So the story got published with the vulnerability live.
This is a disclosure failure on multiple fronts simultaneously. The app's operators didn't have a security contact or a bug bounty program. The developer apparently doesn't answer press inquiries about security issues. And the organization running a global app with hundreds of thousands of users couldn't be moved to patch a zero-effort exploit over the span of months.
Religious and non-profit organizations routinely outsource their digital infrastructure to communications agencies who specialize in brand and UX, not security architecture. There's often no security team, no incident response plan, no coordinated vulnerability disclosure policy. The result is exactly this: an exploitable flaw that sits open for half a year while the disclosure process bumps against institutional indifference.
## Who's Actually in This Database
The data itself — names, emails, countries — reads as relatively benign at first glance. It's not financial data. There are no passwords in the exposed endpoint, no payment details.
But read the user base more carefully.
Click to Pray claims users in essentially every country on earth. That means this database almost certainly contains people in China, where underground Catholic congregations operate outside state-sanctioned churches and religious identity carries real legal risk. It contains users in countries across the Middle East and North Africa where conversion from Islam can carry criminal penalties. It contains people in nations where being publicly identified as a practicing Catholic, or as a Catholic who engages with Vatican digital services, could invite scrutiny.
A name and an email address attached to a specific Catholic prayer app is not just contact information. It's a religious affiliation record. For a meaningful fraction of Click to Pray's global user base, that data carries weight that goes beyond spam or phishing risk.
Nobody appears to have publicly made this point yet.
## What Should Happen Next — and Probably Won't
The Vatican's communications apparatus is not built for rapid technical response. That's not cynicism, it's organizational reality. But La Machi, as the entity that designed and deployed the application, has professional liability here that the Vatican itself doesn't carry in the same way. A communications firm that ships a public-facing app with unauthenticated API endpoints exposing user PII has delivered a defective product.
Defenders in similar positions — NGOs, religious organizations, mission-driven non-profits running apps built by agencies — should treat this as a forcing function to audit their own third-party-developed APIs. Ask: does every endpoint that returns user data require authentication? Are user IDs guessable or sequential? Is there a contact point for vulnerability disclosure? If any of those answers are no, you have a Click to Pray situation waiting to happen.
---
## HackWire Analysis
Six months of exposure for a trivially exploitable IDOR is bad enough. But the real story here sits at the intersection of two trends that deserve more attention together.
First: the agency-built app problem. Religious organizations, charities, and NGOs increasingly operate global digital infrastructure — apps, portals, membership databases — built by marketing and communications agencies under tight budgets and without dedicated security review. The agency delivers a functional product, collects payment, and moves on. Security testing, if it happens at all, is cursory. There's no ongoing relationship when vulnerabilities surface. BobDaHacker and Dark Reading's months-long disclosure odyssey is what happens when you remove every institutional mechanism for fixing security problems from the development chain.
Second: the religious identity database problem. This class of breach rarely gets the scrutiny it deserves because PII is treated as a monolithic category. A name and email exposed from a fitness app and a name and email exposed from a religious affiliation app are not equivalent risks. The latter is a targeted dataset for governments, employers, or bad actors who want to identify members of a specific faith community. We've seen health data and political data get special handling in breach analysis; religious identity data should join that conversation.
The GDPR question here is also live. The Pope's Worldwide Prayer Network processes data on EU residents. A fully exposed, unauthenticated endpoint leaking PII for six months isn't a gray area under Article 32. Whether the Irish DPC or another supervisory authority moves on this is a different question — but the exposure, if confirmed to include EU user data, checks every box.
Until La Machi or the Pope's Worldwide Prayer Network patches this endpoint, every new signup is handing their information to anyone who knows where to look.
— HackWire Editorial
---
## Related Coverage