The Official Mimolet Response to the Habr Articles

The central logical error

An open dating service does not mean unrestricted access to all data

Mimolet is an open dating service. A user publishes a profile so that other participants can see its name, bio, city, interests, and selected photos. Viewing that profile and liking it within product rules is a core feature, not a vulnerability by itself.

The same boundary exists across social networks and messengers. A public photo rendered on a screen can be saved with technical tools. A presigned URL can limit the lifetime of a link, but it cannot prevent a screenshot or a copy of a file that a browser already received. The real security task is to separate public content from private data, avoid exposing unnecessary identifiers, and constrain mass automation.

Claims 2, 3, 7, and 9 in the original article

The routes cited by the author are not the current Mimolet API

The article refers to profile_view.php, feed_classic_api.php, and a negative offset parameter. Both named routes now return HTTP 404, and the described negative offset is absent. Current profile and feed API routes return HTTP 401 without authentication.

The original text also contradicts itself. Its heading says that profiles are available "without authentication" and states "There is no auth", but the next paragraph says that a valid PHPSESSID is required. A valid session is a form of authentication. That does not remove the need for correct authorization in legacy code, but it makes the sensational claim of "no authentication at all" inaccurate even under the author's own description.

A 404 response today does not prove or disprove the exact state of code at a particular moment in the past. It proves something else: applying a description of those files to current Mimolet is technically incorrect.

Likes, action tokens, and Premium

The ability to like a known profile does not erase subscription value

The author combines two different features. The first is reacting to a public profile the user already knows. The second is discovering who liked you and processing incoming likes in bulk. Premium sells additional interface capabilities and access to incoming likes. It does not sell an exclusive right to like a person discovered elsewhere in the service.

In the current implementation, reactions use an authenticated server route and are constrained by the server. The free incoming-likes response does not reveal a real ID, name, or original photo URL. Bulk responses require a server-verified subscription. The alternative PHP handler described by the author has been removed.

The public ability to like a profile and the paid ability to reveal incoming likes are not the same product action.

Claim 5 in the original article

Multiple sessions and no rigid IP binding do not demonstrate session fixation

Session fixation is a specific attack in which an attacker forces a victim to use a session identifier already known to the attacker. The existence of several simultaneously issued sessions does not demonstrate that attack. Multiple sessions are normal because people sign in from phones, computers, and Telegram Web.

The article presents rigid IP binding as mandatory "basic security". In reality, it breaks mobile networks, CGNAT, VPNs, and users whose addresses change. Modern protection relies on secure tokens, expiration, server-side account status checks, and revocation instead of assuming that one IP address equals one person.

The substantive question is whether a banned account can continue performing actions. The current API checks ban status on every authenticated request, not only when the UI opens.

Claim 6 in the original article

A public profile photo is not the same as a publicly listable bucket

The article uses the phrase "public S3" as if any visitor could browse a directory of all objects. These are different access modes. Public listing of the Mimolet bucket is disabled and returns HTTP 403. Individual photos from public profiles are intentionally accessible by URL because browsers and applications need to display them.

Current media names use UUIDs, and locked incoming-like previews use opaque paths without a user ID. This removes the relationship described in the article between a predictable Telegram ID and a file path. Mimolet also does not pretend that saving an already displayed public image can be made physically impossible. No open dating service or social network can honestly make that promise.

Scraping, offsets, and rate limiting

Automation exists around every public service. The question is scale and friction

Scraping is not unique to Mimolet. Third parties try to collect public pages and media from Instagram, TikTok, Telegram, marketplaces, and dating services. The existence of those tools does not prove that a service "released its database" or exposed private data.

Mass automation should still be more expensive and visible. The current architecture uses mandatory authentication, server-side action limits, ban checks, and protection against direct profile enumeration. The negative offset technique belongs to a removed API and is absent from the current contract.

The categorical statement that there is "no rate limit" also does not describe the current product. Limits are enforced on the server and depend on action type and subscription tier. We intentionally do not publish a complete map of anti-abuse controls because an official response should not become a guide to bypassing them.

The headline claiming "43%"

The author's sample does not establish the composition of the entire audience

The post provides no independently verifiable dataset, sampling method, deduplication process, completeness estimate, or evidence that 12,340 collected cards equal the entire audience or MAU. It also combines ages 15 through 19 into one group. That range includes both minors and adults, so it cannot be labeled entirely as "children".

Age in dating and social services is commonly self-declared. A profile value cannot retrospectively establish a person's identity or actual age. The dramatic percentage in the headline is therefore the author's classification of an unverified sample, not an established fact about Mimolet users.

The current service is intended for users aged 18 and older. Moderators review reports on the day they are received, and accounts that violate the rules are blocked. This is a practical response mechanism. Passport checks are not a universal industry standard.