---
title: "The question nobody could answer"
author: "Jeferson Guardezi"
date: "2026-11-01T04:17:54.169Z"
updated: "2026-11-01T04:17:54.492Z"
lang: "en"
pillar: "Business"
canonical: "https://guardezi.com/en/writing/the-question-nobody-could-answer"
translations:
  en: "https://guardezi.com/en/writing/the-question-nobody-could-answer"
  pt-BR: "https://guardezi.com/pt/writing/a-pergunta-que-ninguem-consegue-responder"
  es: "https://guardezi.com/es/writing/la-pregunta-que-nadie-pudo-responder"
---

# The question nobody could answer

> A company found its customer-list password sitting inside its own app. The owner's problem was not that. It was the next question, which nobody could answer.

An American restaurant company found out that the password opening its customer list was sitting inside its own app. Anyone with the app installed had it. More than a million phones had downloaded the thing.

That is bad. But it is not what interests me here.

![An open padlock, with the record of who came in faded beside it](https://guardezi.com/api/media/posts/the-question-nobody-could-answer/fechadura-sem-registro/1600.webp)

## The question that undid the answer

Asked about it, the brand's owner said it had found no sign that anyone used the password.

Then came the second question: is there a record of who got in?

No answer.

The second question is where the owner's problem lives. The first answer sounded reassuring. After the second one, it became something else: "we found nothing" stopped being a statement about what happened and became a statement about how far anyone looked.

## Changing the password is the cheap part

A password changes in an afternoon. What does not change in an afternoon is the record of who came in — because it only exists if it was switched on beforehand.

You cannot produce in October the record nobody turned on in July. It is the one part of this story money cannot fix afterwards.

That is the difference between an expensive problem and a dead end. The expensive one you pay. The dead end you explain.

## What it asks of whoever runs the place

This is not about apps. Your company has some list worth money — customer records, price tables, order history. Three questions:

1. Who can open it?
2. Is it recorded when they do?
3. If a customer calls tomorrow asking who saw their data, how fast do you answer?

If the third question has no answer, the other two do not either — you just have not had to find out yet.

On the mat nobody steps up swearing they will not fall. You train to know what to do when you do. Business is the same: an owner is not the one who promises nothing goes wrong. It is the one who answers when it does.

The bakery down the street writes down who opens the till. Your customer list is worth more than the till.

---

*The reporting on this case — what was found, how, and what the company said — belongs to the [Silicon Village blog](https://svdev.tech/pt/blog/applebees-app-password-no-logs). Here I look from the other side: not what broke in the engineering, but what it asks of whoever decides.*