HookLink
HookLink
HookLink is a Miami dating app running a full multi-service stack: a marketing site, the dating app and its API, a photo service, a subscriptions service, and an internal Trust & Safety console. Seven flags, one engagement — start as an anonymous visitor and end holding 180,000 people's most sensitive data.
The Engagement
HookLink's investors want a clean external pentest before the next round. You're handed the public surface and a single member account — nothing else. Work the dating app, its API, the photo service, the subscriptions service, and the internal moderation console, and see how far a startup that "shipped fast and would lock it down later" really lets you get.
Background
HookLink launched in 2023 — two UT Austin grads who thought dating apps had become slot machines and built one around 50 compatibility questions instead. It worked: 180,000 members across the southeast, a seed round, a five-person team. What didn't keep up was the security. Features shipped on Friday nights. The API trusted the app. Internal tools were left reachable because locking them down was always next sprint's problem. None of the bugs here are exotic — they're the ordinary, devastating kind a small team accumulates under deadline. But this is a dating app, and dating data is the most dangerous consumer data there is. Ashley Madison's breach in 2015 exposed 37 million people and led to extortion, ruined careers, and reported suicides. Grindr shared users' HIV status; researchers trilaterated Bumble and Hinge users to within two metres of their front doors. Every flag in this range maps to a real disclosure that affected real people — sexual orientation, private photos, home coordinates, the contents of private conversations. The impact isn't a debug banner. It's a human-safety problem.
WebRanges are included in Pro+. Get the full platform for $19.99/mo.
Get Pro+Open in dashboardTechniques