Multiple vulnerabilities have been discovered in the Android dating app BaseChat, version 9.8.1. These issues pose a significant risk to user privacy and data security. One vulnerability allows attackers to bypass TLS security checks by accepting self-signed certificates for backend API connections. Another concern is the use of raw MSISDNs, or phone numbers, to map paid accounts to the RevenueCat subscriber database. Because a public API key for RevenueCat is embedded in the app, attackers can query this database using guessed phone numbers. This allows them to retrieve user metadata, including activity and purchase history. The application also logs Personally Identifiable Information (PII) in its production build. Specifically, it records the phone numbers of other callers during voice calls through un-stripped debug statements. These vulnerabilities, if exploited, can lead to account takeover, theft of session credentials, and exposure of private user data. Attackers can also access the PII of other users who are meant to remain anonymous. The app sending other users' phone numbers to the client in any capacity is considered a privacy violation. The developers of BaseChat could not be reached to address these vulnerabilities.