How I Found Critical Security Vulnerabilities in a Government App And Why I Reported Them
I am a security researcher from Nepal. Like many people in this country, I use government digital services regularly. One day, while doing routine security research, I stumbled upon something that stopped me cold a government application exposing the personal data of thousands of Nepali citizens, completely unprotected, wide open on the public internet.
Thank you for reading this post, don't forget to subscribe!This is the story of what I found, what I did about it, and why responsible disclosure matters especially in a country that is rapidly building its digital future.
What Is the Nagarik App?
The Nagarik App is the Government of Nepal’s official digital citizen services platform. It allows Nepali citizens to access government services digitally from birth registration and identity verification to vehicle registration checks and more. It is a critical piece of Nepal’s digital infrastructure, used by millions of citizens across the country.
With great power comes great responsibility. And unfortunately, the security of this platform had some serious gaps.
What I Found
After conducting a professional Vulnerability Assessment and Penetration Test (VAPT), I identified 11 security vulnerabilities across the Nagarik App development infrastructure. The overall risk rating came out at CRITICAL CVSS Score 9.8 out of 10.
Here is a breakdown:
| Severity | Count |
|---|---|
| 🔴 Critical | 3 |
| 🟠High | 5 |
| 🟡 Medium | 3 |
The Most Shocking Finding
The single most alarming discovery was an unauthenticated API endpoint running on a public-facing server.
What does “unauthenticated” mean? It means anyone on the internet no password, no token, no login required could access this endpoint and download thousands of real Nepali citizens’ personal data.
The exposed data included:
- ✦ Full citizen names
- ✦ Mobile phone numbers
- ✦ Birth registration certificate details
- ✦ Firebase Cloud Messaging (FCM) push notification tokens
- ✦ Citizen IP addresses and device fingerprints
- ✦ Complete government service request and response payloads
Total records exposed: 10,000+ Unique citizens identifiable: 1,000+
A malicious hacker could have downloaded this entire dataset in under 2 minutes using nothing more than basic HTTP requests. No special tools. No hacking skills. Just a web browser.
Other Critical Vulnerabilities
Beyond the data exposure, several other serious issues were identified:
🔴 Django DEBUG Mode Enabled on a Public Server
The web framework powering the backend was running with DEBUG=True on a live, internet-facing server. This means every error page was leaking internal application structure, URL routes, Python code, and potentially the application’s SECRET_KEY the master key used for cryptographic operations. In the wrong hands, this could allow session forgery and complete account takeover.
🔴 Firebase Cloud Messaging Token Exposure
Over 1,000 unique FCM push notification tokens belonging to real citizens were exposed in the data. These tokens can be used to send fake push notifications directly to citizens’ phones impersonating the official Nagarik App. Imagine receiving a fake government notification asking you to “verify your identity” that is exactly the kind of phishing attack this enables.
🔴 Hardcoded AES Encryption Keys
The AES encryption key and initialization vector (IV) used for QR code-based citizen identity verification were hardcoded directly in the application source code and exposed via a leaked configuration file. Anyone with these keys could:
- Decrypt any citizen’s identity QR code
- Forge QR codes with arbitrary citizen identities
- Bypass QR-based government identity verification entirely
🟠OAuth Credentials for Vehicle Registration System Exposed
OAuth 2.0 client credentials for the Vehicle Registration System (VRS) were fully exposed in a configuration file. These credentials could allow unauthorised access to vehicle registration data and potentially enable modification of vehicle ownership records.
🟠Swagger API Documentation Publicly Accessible
The complete interactive API documentation was publicly accessible without any authentication essentially handing attackers a detailed map of every endpoint, every data structure, and every authentication mechanism in the system.
Why This Is Serious Beyond the Technical
From a legal standpoint, these vulnerabilities represent potential violations of:
- Nepal Privacy Act 2075 Sections 7, 8, and 9 relating to collection, security, and disclosure of personal information
- Nepal IT Bill Sections 46 and 47 relating to unauthorised access to computer systems
- OWASP Top 10 (2021) Multiple categories including Broken Access Control and Cryptographic Failures
But beyond laws and frameworks, this is serious because real people are affected. Real Nepali citizens who trusted their government with their personal information had their data sitting exposed on the public internet. Phone numbers that can be used for fraud. Names that can be used for identity theft. Birth registration details that can be misused in ways we may not even anticipate.
Nepal’s digital government services are growing fast. That is a wonderful thing. But growth without security is a risk that ultimately falls on ordinary citizens.
What I Did Responsible Disclosure
When I found these vulnerabilities, I had a choice. I could have:
Ignored it Exploited it for personal gain Sold the information
Instead, I chose the right path responsible disclosure.
Here is exactly what I did:
- Documented everything compiled a full professional VAPT report with detailed findings, proof-of-concept evidence, and a complete remediation roadmap
- Did not exploit any data no citizen data was downloaded beyond what was necessary to prove the vulnerability existed
- Did not share findings with third parties the information was kept strictly confidential
- Submitted the report to the concerned authority at the Nagarik App / Government of Nepal
- Provided a full remediation roadmap with clear timelines Immediate (24 hours), Short-Term (1–2 weeks).
This is what ethical hacking looks like. Finding the problem. Reporting it. Helping fix it.
The Remediation Roadmap We Provided
We did not just report the problem we provided a complete solution plan:
Immediate (Within 24 Hours)
- Block public access to the exposed port
- Disable Django DEBUG mode
- Rotate all exposed encryption keys and OAuth credentials
- Remove real citizen data from the development environment
Short-Term (1–2 Weeks)
- Implement authentication on all API endpoints
- Enable HTTPS across all services
- Upgrade Elasticsearch to a supported version
- Add missing security headers
- Rotate all exposed FCM tokens
Medium-Term (1–3 Months)
- Fully separate development, staging, and production environments
- Implement proper key management (KMS/HSM)
- Add mutual TLS for service-to-service authentication
- Implement centralised logging with PII redaction
Long-Term (3–6 Months)
- Integrate automated security testing into the CI/CD pipeline
- Conduct regular penetration testing
- Establish a bug bounty programme
- Security awareness training for all developers
What I Want Other Security Researchers in Nepal to Know
Nepal’s cybersecurity community is small but growing. If you find vulnerabilities in systems especially government systems please follow responsible disclosure. Here is why it matters:
1. It protects citizens. The goal of security research should always be to make things safer for real people. Exploiting vulnerabilities hurts the very citizens we should be protecting.
2. It builds trust. When researchers act responsibly, it builds trust between the security community and the organisations we research. That trust opens doors bug bounty programmes, collaborations, and a healthier security ecosystem.
3. It is the right thing to do. Simple as that.
4. It protects you legally. Responsible disclosure, properly documented, demonstrates good faith and protects researchers from potential legal consequences.
Lessons for Developers and Government Teams
If you are building digital services especially government services that handle citizen data here are the key takeaways from this research:
- Never expose development environments to the public internet
- Never store real citizen data in development environments
- Always require authentication on every API endpoint no exceptions
- Never hardcode credentials, keys, or secrets in source code
- Always disable DEBUG mode before deploying anything to a server
- Conduct regular security testing VAPT is not a one-time exercise
- Have a responsible disclosure policy so researchers can report to you safely
Security is not a feature you add at the end. It is a foundation you build from the beginning.
Final Thoughts
Nepal is on an exciting journey toward digital governance. The Nagarik App and platforms like it have the potential to genuinely transform how citizens interact with their government making services faster, more accessible, and more efficient.
But that transformation must be built on a foundation of security and trust. Citizens are sharing their most sensitive personal information with these platforms. They deserve to know that information is protected.
I am proud to have contributed in a small way to making that foundation a little stronger. I hope this disclosure leads to swift remediation and that it serves as a reminder that security must always be a priority, not an afterthought.
To the Nagarik App team: we are not your adversaries. We are on the same side. Let’s build a safer Digital Nepal together. 🇳🇵
Report prepared by: Samir KC & Bikash Poudel, Independent Security Researchers, Nepal Testing conducted: June 2026 Methodology: OWASP Top 10, CVSS v3.1, NIST SP 800-115 Classification: Public Disclosure (post-remediation)
All testing was conducted ethically and responsibly. No citizen data was exploited or distributed. This article is shared for educational purposes and to encourage stronger security practices in Nepal’s digital government infrastructure.
