# Protected Tweets setting overridden by Android app

Android app's DM settings update silently reset the account's Protected Tweets flag, making previously private tweets public without user awareness.

- Payout: $560
- Severity: low
- Program: X / xAI
- Credited: alexiaya
- Disclosed: 2019-05-17
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/519059
- Library page: https://bugbountylibrary.com/r/h1%3A519059
- Tags: domain:api domain:mobile impact:integrity impact:pii-leak kind:bounty platform:hackerone sev:low tech:android technique:second-order vuln:access-control vuln:business-logic

**Target:** com.twitter.android DM settings screen (mobile app settings API)
**Root cause:** The Android app sends a settings update payload that includes a stale/default value for the protected-tweets flag when changing unrelated DM settings, overwriting the server-side setting.
**Steps:**
1. Log in on Android app with unprotected tweets.
2. On mobile.twitter.com enable 'Protect your Tweets' and confirm tweets are protected.
3. In Android app open Direct Messages tab, tap gear icon, change 'Receive message requests' or 'Show read receipts'.
4. Observe account tweets become unprotected.
5. If not reproduced, first unset protected tweets in the app, then set it on web, then repeat step 3.
**How found:** Tester noticed the app's settings screen likely submits a full settings object; hypothesized that changing one setting would resend other fields with stale values, then verified by setting protected tweets out-of-band on web and toggling a DM setting in-app.
**Exploitation:** Requires the victim to change an unrelated DM setting in the Android app after enabling protected tweets elsewhere; the app then silently publishes the account. Attacker could socially engineer the user to toggle a setting.
**Insight:** When a mobile client edits settings, test whether it PATCHes a full settings object rather than a single field: set a privacy flag out-of-band on web, then change an unrelated setting in-app and check if the flag reverts. Stale full-object writes are a recurring privacy-bypass pattern.