We've all been on both sides of it. There's the colleague with spinach in their teeth just before the big presentation, or the stranger in the queue whose fly is open. Saying something is awkward. Hearing it is even worse, and your cheeks go a lovely shade of beetroot.
But there's only one good answer: "Oh no. Thank you!" Then you quietly sort it out and get on with your day. Nobody ever says, "How dare you look at my teeth?"
This week, South Africa watched that moment play out on a much bigger stage.
The panic button with its data showing
Gauteng's e-Panic Button app is meant to help residents in danger, and has more than 280,000 registered users. The system behind it reportedly runs on a five-year contract worth R269 million.
In September, a computer science student found that the database behind the app was open on the internet. Users' names, phone numbers, locations and crime reports, including domestic violence reports, were visible to anyone who knew where to look. (A database is the digital filing cabinet where an app keeps its information.)
He didn't break in. He studied the public app and the services it talks to. In his words: "We broke no laws and did no hacking. A tech-savvy computer user could easily have replicated what we did."
So he did the kind, awkward thing and spoke up. On 21 September, the news site he worked with told the department and Evolve, the company running the system. Evolve gave the textbook answer: it fixed the problem quickly and thanked the news site.
The department didn't reply. It later said no personal information had been compromised, and it notified the Information Regulator on 5 October, about two weeks after it was alerted. A department slide shown to the legislature referred to a criminal case dated 6 October, which the province reportedly plans to pursue. It's unclear whether one has formally been registered. The MEC for e-Government said it is "standard practice" to open a police case when a breach is recorded.
Legislature committee chair Mbali Hlophe put the problem neatly: "A criminal case does not secure a single resident's data, and it warns everyone who finds a flaw in a government system to stay silent next time."
That's the spinach problem in a sentence. Get cross at the person who points it out, and next time nobody will.
We're not here to pile on. Running big systems is hard, and being told about a gap is genuinely embarrassing. But it's a useful mirror for business owners, because one day someone will tap you on the shoulder too.
How to take the tap on the shoulder
Say thank you first. The person who tells you something is open has done you a favour. The next person to find it might not knock.
Make it easy to tell you. A short "spotted something wrong? - Tell us here note on your website, with one email address, turns an awkward moment into a helpful one.
Tell the Regulator promptly. Under POPIA, South Africa's privacy law, a breach must be reported to the Information Regulator "as soon as reasonably possible". Gauteng's legislature committees objected to the two-week wait. Decide now who makes that call in your business.
It's not just government
Ampath Laboratories reportedly suffered a cyberattack on 2 October, names, ID numbers, contact details, medical aid details and payment-related information may have been taken. Ampath says there's no evidence that test results or banking details were taken. It notified the Information Regulator and restored the affected web server "from a clean backup". Clear notice and a copy the attackers couldn't touch: that's what you want on your worst day.
Bootlegger's internal dashboard showed a login screen, but the data behind it was sent to the browser along with the login page, so anyone viewing the page's code could read it. MyBroadband described it as a "vibe-coded" app, meaning one built quickly with help from AI tools. The company says it was an old version that hadn't been fully switched off. It took the dashboard offline on 15 October and is notifying those affected. The lesson: a login screen isn't security, and the old system you forgot about is still online. AI tools are brilliant (we use them too). Just have someone check where things live before real data goes in.
Certainty is Freedom
Certainty doesn't come from never having spinach in your teeth. It comes from knowing where your gaps are before someone else finds them. If you'd like a calm starting point, try our 5-minute Risk Check at riskcheck.enablr.tech, or ask for a complimentary Spend Audit, with results in 48 hours and no obligation.
And if someone ever tells you your fly is open? Say thank you. Then fix it.