I hacked a dating app (and how not to treat a security researcher)

FYI the Hinge app works the same way

I requested my data and all the image URLs are publicly accessible - and the URLs provided are both your own images and the images of anyone who’d ever viewed your profile

The security is in the fact that you cant just list every single user and all their info. You would need to scrape the info.

A URL with a cryptic file name is theoretically just as secure as a a random password.