Chinese Civic Apps Found Vulnerable Due to Shared Backend with Recoverable Signing Secret

The post describes a set of Chinese government-adjacent apps that use the same backend system for rewards and lotteries. The secret key meant to secure reward claims and lottery outcomes is not properly protected and can be recovered from the client. This vulnerability allows attackers to forge valid reward claims or manipulate lottery results that the backend will accept as authentic. The post details the process of tracing the shared backend and locating the exposed secret.