the notion is behind a login screen. for better or for worse

wonder what "Lock-In" means specifically in this case. like their state management is causing ui bugs? surprising for an app that feels so frictionless.

the tooltip says "Give Feedback" like… you wouldn't suspect this is supposed to be internal until you tap it

also if i switch my system language (like to ru-RU in this case), the screen is also localized. quite an effort to localize a screen that's supposed to be internal and for dev purposes only

.@1password your l10n seriously needs work though. text truncation is unacceptable also since this screen uses a lot of tech/swe terms, half the translations ended up very clunky (and barely understandable tbh) as they're hard to map to Russian directly

@1Password if you're localizing dev screens, at least… qa them? i do ios localization/internationalization consulting and i spot this stuff all the time. happy to help btw (shameless upsell, yes)

holy shit. if i type into the "search related feature" box it actually works and lists like a giant list of 1password-related internal features. don't know if i can dump it/brute force all the combinations. @1password if i were you i'd patch this like right now

if you're wondering how i got in there... nothing fancy. just an OTA google play update probably. opened 1password to sign up for a website until i saw that tiny ladybug icon and got curious. so... you don't even need reverse engineering skills for this

i seriously hope @1password at least have a feature flag for this... cos i don't want to logcat/wireshark to feed my curiosity lol

@1Password also just switched to ar-AE in hopes to test their rtl support too. they don't have Arabic support. it defaults to English

@1Password which… it shouldn't. because the next language on my list is Russian. which 1password *does* support. i know that Android sucks in terms of multilingual l10n (in fact the API was only added to Android 13 two yrs ago) but i expected better from 1password

@1Password inb4 "no android app supports this": google keep does that. it falls back to Russian in the above case. can't screenshot yet so just trust me lol

in case you're wondering... i did manage to dump the list of searchable features not giant. but definitely very peculiar

suggests there are some gov tech contracts involved. and lots of interesting integrations that are not obvious to a naked eye (fastmail, salesforce)

speaking of logs... they seem to show some ruby files related to locking and unlocking (remember "Lock-In" above in the thread?) and also Mycelium which is likely another internal component

if you're curious what happens when i tap "submit"... nothing.

or, actually, the logger shows a "TitleError". probably because i left it empty

weird... for such a polished ui where they even went through the effort to order localized string values for it... ...but didn't go through the effort of adding a snackbar or error message for their own QA

but then i worked with teams who just ordered localized assets without second thought (and usually never even bothered to test them) so i'm not surprised. so if you wonder where all your budget goes next time... blame whoever handles the localization

once I enter a title and tap submit... also nothing. but this time there is no error message. so probably the requests i'm sending right now *are* getting sent

someone in Toronto is probably checking their bug tracker to see tickets labeled "lol" and "lmao" coming from me probably

still can't Wireshark into my device yet. hope it's not too hard and i won't give up midway

unrelated but: after switching languages a few times, the apps on my Z Fold5 sorted like A → B → ... → Z → A → T → B (and not A-Z) no custom launcher, just One UI. tried to screenshot, but unfolding the phone restarted the activity and reset it. s.o. to @SamsungMobile

fwiw some ppl are like "press x to doubt": i didnt dump everything. i wont post screenshots of fields labeled iInfra, sendmail, or the internal Notion url itself. just flagged that a debug screen shows up in a prod build. community's onto it. not a breach, but not nothing either.

for context: ive been a 1password user for 5+ yrs. not roasting anyone. just trying to surface a bug that probably wasnt meant to be in prod. i like the product. its saved me many times. but ive seen flaky stuff sneak through before. figured this one deserved a flag.

peculiar finding after proxying 1password requests: seems to use notion as the backend for its forms. but not in a webview. i'm betting it was made with jetpack compose (judging by how state update works and how it's a completely separate activity from the main activity)

also an unrelated peculiar finding: @EmbargoApp is logging like crazy. high quantities, low refresh count. funny for an app that's just discounts & food delivery. if i were them, i'd reconsider how often my backend is being queried. must have quotas in four figures at this scale.

@EmbargoApp but speaking of 1password, it's also ssl pinned (as expected from a password app at this scale.) some shady apps from gplay don't do pinning though. but i digress. so despite this... ahem, funny dev ui, i have very little reason to think the backend isn't robust and well-handled.

so... a summary of what i found: - debug screen shipped in prod 1password android build - hidden behind an obvious button in autofill flow - localized!! (poorly) - internal-only fields - not a sec breach - likely just a qa tool that slipped through

thats all for today. im sleepy. will keep posting if anything else pops up, but for now i think thats the full picture. thats all folks!