The Gauteng provincial government has moved to reassure residents that vulnerabilities in its e‑panic button app have been addressed after computer science students from Stellenbosch University discovered an unauthenticated database containing user information.
Students find open database while analysing app code
Two students conducting a static analysis of the app’s code last week found that a database storing user details was accessible without authentication, according to reporting and statements from the province. One of the students, Joel Cedras, who previously exposed weaknesses in the South African Social Security Agency database, is reported to have been able to view personal information including addresses, identity numbers, licence plate numbers, contact details and the specifics of crimes reported by users.
“The platform is part of government’s commitment to harness technology to strengthen public safety, improve access to emergency services, and ensure that residents can summon assistance quickly during moments of crisis,” the provincial government stated.
The provincial e‑government department said it had “identified an attempted security breach” and that its technical teams acted decisively. The department added that the digital holes had been patched and that enhanced cybersecurity protocols would be implemented going forward.
How many people use the app?
The department released figures showing the scale of the system since its launch in July 2024. As of the department’s report there were 288 307 active users, who had logged 114 414 emergency call‑outs, culminating in the reporting of 59 394 crimes.
| Metric | Number |
|---|---|
| Active users | 288 307 |
| Emergency call‑outs logged | 114 414 |
| Crimes reported via app | 59 394 |
What the students reported and what officials said
Cedras told SABC News that the database was accessible to anyone with a basic understanding of the framework and that the app’s privacy policy claims data is encrypted, even though he could see sensitive fields in plain view. The province, while acknowledging an incident, said the attempted breach involved “a highly specialised organisation with advanced cybersecurity expertise and capabilities in vulnerability identification and security testing.”
The department insisted that an average IT professional could not have carried out the attempt and emphasised that corrective action had already been taken.
Practical implications for users
For the nearly 300 000 residents who have registered, the discovery raises immediate questions about data security and user safety. Officials have encouraged continued use of the e‑panic button while they roll out tightened safeguards. Users should consider the following steps:
- Review and, where appropriate, update contact details in the app.
- Limit personal information entered into app profiles where possible.
- Watch for official communications from the provincial e‑government department about forced password resets or security updates.
- Report any suspicious contact that appears to leverage information from the app to the SAPS and to the provincial helpdesk.
Why this matters locally
Gauteng’s e‑panic button was rolled out to make it easier for residents to summon assistance and to flag emergencies to authorities. The province’s figures indicate substantial use and reliance on the platform to report crime and to call for help. A security weakness in such a system can undermine public trust and expose vulnerable users to further risk, particularly if identifying information is viewable.
Cybersecurity experts often warn that publicly accessible or poorly configured databases are a common vector for data exposure. When public services handle sensitive personal data, robust authentication, encryption at rest and in transit, and regular security audits are widely recommended best practice.
What officials promise next
The e‑government department said technical teams had acted to patch the vulnerability and would introduce tighter cybersecurity protocols. It did not set out a public timetable for further audits, independent penetration testing or a third‑party review of the system.
Residents with concerns are advised to follow official provincial channels for updates and to report any suspected misuse of personal information to the SAPS. The unfolding response and any independent verification of the fix will be key to restoring confidence in a service intended to protect people during emergencies.
