md` The City of Los Angeles [spent $300,000](https://www.latimes.com/local/lanow/la-me-quake-warning-challenges-20190104-story.html) for an earthquake alert app that contains several security vulnerabilities, has no tests, and tracks thousands of users' precise location.
ShakeAlertLA is a simple - users download the app, consent to location sharing, and they're done. Using the US Geological Survey's new early warning system, the app will send a notification and play an alarm if a predicted > 5.0 magnitude earthquake happens, giving potentially 10's of seconds of warning to thousands of users across Los Angeles County.
However, as shown by a now-deleted repository of the app's codebase, there are several alarming features of the Android app and the server that handles the app's features, including the accuracy of the app's location tracking, the potential plaintext passwords and API keys to access the app's database and governement services, and the lack of any tests for the projects features, making the entire app unreliable, unsafe, and a failure of civic tech.

screenshot of the open-source code of the MyShakeLA app that contains passwords other credentials

Example of a file from the ShakeAlertLA public codebase containing login credentials, including password, to a federal government service

### Background
The City of Los Angeles has an [organization on GitHub](https://github.com/CityofLosAngeles) - a site where users share open-source software projects. In their organization, they have several "repositories" - which are open codebases that show the entire history of a project.
On January 2nd, this organization had 3 repositories related to the ShakeAlertLA app - one for the Android app codebase, another for the iOS app codebase, and another for a server that handled database and the alert features. That day, Hunter Owens, a data scientist for the city, tweeted in celebration that the app was live and that the code was open source.
The next day, on January 3rd, the Android and iOS repositories were deleted from GitHub, and Owens [deleted his tweet](https://twitter.com/hunter_owens/status/1080548642698588161). On January 8th, the server repository was deleted.
A backup of the now-deleted Android and server code were made, revealing all of the issues listed below. Keep in mind, all of this code and snippets were once available for anyone to view for free on GitHub. This did not come from some breach or decompiling process, it was all freely available.
`