Xavier Lampkin on TeaOnHer

In 2025 I built and ran TeaOnHer, a dating review app, by myself. I released it publicly on the App Store as a beta for a testing team that wanted it public instead of on TestFlight. It went viral from there. Within weeks it was near the top of the App Store charts, reaching 4 million users in less than 2 months. It grew faster than one developer could safely run it.

What happened

On August 6, 2025, TechCrunch reported a security flaw. The admin API routes didn't require authentication, and user verification images, including ID photos, could be reached through direct links.

I fixed it that day, within about nine hours. I put authentication on every admin route, made storage private with signed URLs, closed public network access to the database, and added rate limiting. Affected users were notified.

Those flaws were my mistakes, and I own them.

Moderation and shutdown

I also built content moderation: automated image screening, text filtering, blocking, and a way for people to report reviews about themselves. It wasn't enough. I came to see the review-others model as flawed, and I shut the app down in October 2025.

The inquiry

The House Oversight Committee opened an inquiry that month, and I've cooperated with its document requests. They have all the documents, and I'm waiting to hear back from them.

What changed

Security comes first in everything I build. Storage is private by default, every endpoint requires authentication, and I plan for scale before launch.

Talk to me

If you're considering me for a role and want to talk this through, I'm happy to.