Techin' Geek

An Amazon-hosted storage server, accessible to the public, permitted anyone with internet access to view what could potentially be hundreds of thousands of individuals’ personal information without a password. This encompassed driver’s licenses, passports, and other personal details gathered by the Duc App, a money transfer platform owned by the Toronto-based company Duales.

The Canadian fintech firm announced it addressed the data breach on Tuesday after TechCrunch informed its CEO that one of the cloud storage servers was openly listing its files without any password protection.

Moreover, the data was stored in an unencrypted format, allowing anyone with a link to access the information completely.

Anurag Sen, a security expert at CyPeace who identified the security flaw earlier that week, reached out to TechCrunch to alert the data owner. Sen mentioned that anyone could view and download the data via their browser simply by knowing the easily guessable URL of the storage server.

Sen reported that the Amazon-hosted storage server displayed over 360,000 files containing government-issued documents and other information utilized by customers for identity verification through “know your customer” processes. Among these files were user-submitted selfies to verify their real-life appearance.

TechCrunch could not determine the exact number of exposed driver’s licenses and passports; however, numerous folders in the compromised bucket each had tens of thousands of user-uploaded files, some of which included driver’s licenses, passports, and selfies.

Duales promotes its app as a means for individuals to send money to others, including internationally to locations like Cuba. The app’s listing on the Google Play store shows over 100,000 downloads so far.

The files, with dates going back to September 2020 and being uploaded on a daily basis, also featured spreadsheets recording customer names, home addresses, and details of their transactions including dates and times.

In response to an email inquiry, Duales CEO Henry Martinez González informed TechCrunch that the data was stored on a “staging site,” which is typically a testing website, but did not clarify why customer personal data was accessible publicly in the same database.

“All protections are in place,” Martinez González stated. “We are notifying the appropriate parties. We have not contracted any services from you.”

Following TechCrunch’s email to the company, access to the files on the storage server was revoked, although a list of the server’s contents remains accessible.

Martinez González did not confirm whether the company had the technical capabilities, such as access logs, to identify who viewed the data or how many individuals accessed it.

Duc App’s website seemed to be briefly down on Thursday, presenting a “bad gateway” error.

It remains unclear how or why Duales kept its Amazon-hosted storage server publicly accessible on the internet. In recent years, Amazon has implemented security measures to help prevent users from inadvertently exposing their data online after a series of incidents where notable companies, including a U.S. intelligence agency, mistakenly published sensitive data due to incorrect configurations.

When contacted by TechCrunch as part of outreach efforts to reach the app’s owner, Canada’s privacy regulator stated it was seeking further information from Duales.

“The Office of the Privacy Commissioner of Canada has contacted the company for more information and to determine the next steps,” a spokesperson for the regulator shared with TechCrunch via email, opting not to provide additional comments.

Duc App represents the latest in a series of recent security issues involving the exposure of sensitive identity information belonging to others. This data leak aligns with a trend where apps and sites increasingly ask users to upload government-issued documents for identity verification without implementing adequate measures to protect the data collected.

Last year, the well-known app TeaOnHer disclosed thousands of its users’ passports and driver’s licenses, which the app required for entry into its exclusive community. Additionally, Discord confirmed a data breach last year affecting approximately 70,000 government-issued documents that users uploaded to verify their ages amid a global push to introduce online age verification legislation.

On Thursday, Google introduced new capabilities to its video editing application Vids, such as guiding and personalizing avatars via text prompts, support for Veo 3.1, the option to export videos directly to YouTube, and recording using a Chrome extension.

Users will have the ability to utilize natural language prompts to instruct avatars to “perform” within a scene. This might involve the avatar engaging with a product, a prop, or a piece of equipment. The company noted that in spite of the varied nature of the output, Vids preserves character consistency.

Google indicated that depending on the video’s theme, users can adapt characters by modifying their looks, altering clothing, and generating fresh backgrounds through prompts.

Last month, Google integrated its Lyria 3 and Lyria 3 Pro music composition models into Vids, enabling users to incorporate sound effects or music into their videos. With this update, Google is introducing the Veo 3.1 video-generation model, capable of producing eight-second clips within the video editing platform. The company is offering 10 free video generations each month to all users. Furthermore, Google AI Ultra and Workspace AI Ultra accounts can generate up to 1,000 Veo videos per month.

Additionally, Google is implementing the ability to directly export completed videos to YouTube, eliminating the need to download and re-upload them to the channel. All exported videos are set to private by default, allowing users to review their content prior to making it public.

The company is also introducing a new screen-capturing Chrome extension within the video suite, enabling users to record their screen with audio or video.

Google has been consistently enhancing Vids since its initial launch in 2024 to meet the needs of enterprise content creators. Last year, the company introduced AI avatars to Vids and broadened access for consumers. In February, the company added 2D and 3D cartoon-style avatars and introduced language support for seven new voice-over languages, including French, German, Italian, Korean, Portuguese, Spanish, and Japanese.

Google Vids competes with platforms such as Synthesia, HeyGen, D-ID, and Lemon Slice.

The interim leader of U.S. Immigration and Customs Enforcement informed legislators that the agency has acquired and utilized spyware from Paragon Solutions in drug trafficking investigations, as per a letter reviewed by TechCrunch.

ICE Acting Director Todd Lyons conveyed in his correspondence to three congress members that he sanctioned the agency’s criminal investigative division, Homeland Security Investigations (HSI), to deploy “state-of-the-art technological resources” to combat “foreign terrorist organizations’ rampant exploitation of encrypted communication channels,” in reference to spyware. 

The challenge law enforcement faces in accessing encrypted information has frequently been cited as validation for the necessity of employing computer and cellphone spyware in significant criminal investigations, as it can directly extract data from an individual’s device. Critics and advocates for human rights have long highlighted the escalating number of journalists, political figures, and civil society members whose devices have been compromised by governments utilizing commercial spyware.

In the letter, Lyons stated that ICE’s deployment of spyware would “adhere to constitutional standards,” and that he “certified that HSI’s practical application of the specific tool does not present considerable security or counterintelligence threats, or significant risks of improper employment by a foreign regime or foreign individual.”

Bloomberg was the first to disclose ICE’s correspondence to lawmakers.

In 2024, ICE entered into a contract with U.S.-Israeli spyware firm Paragon Solutions, a contract that was swiftly put on hold by the Biden administration to determine whether it met the criteria of an executive order restricting U.S. agencies from utilizing spyware that could target Americans overseas or violate human rights.

In September 2025, ICE revoked the suspension and reinstated the contract. Nevertheless, it was unclear until now if ICE planned to utilize Paragon’s spyware.

The spyware manufacturer has become embroiled in a extensive scandal in Italy, where it was uncovered that journalists and pro-immigration advocates were targeted using Paragon’s spyware Graphite last year. In response, Paragon severed ties with Italy’s intelligence agencies regarding its spyware products.

When contacted for feedback, Democratic Rep. Summer Lee, one of the lawmakers who sought information from ICE, informed TechCrunch that the agency is now proceeding “with intrusive spyware technology within the United States. 

The legislator further stated, “rather than addressing the serious constitutional and civil rights issues we raised, DHS is urging the public to accept vague reassurances and fear-driven justifications.”

“The individuals most vulnerable, including immigrants, Black and brown communities, journalists, activists, and anyone voicing opposition to government misconduct, deserve more than secrecy and evasion from an agency with a long history of overreach and misconduct,” remarked Lee.

Paragon and ICE did not respond to TechCrunch’s inquiries regarding the agency’s use of spyware.

United Airlines is enhancing its iOS and Android mobile applications with a variety of new functionalities, such as projected security wait times to assist travelers in determining their arrival times at the airport. This initiative arises amid a partial government shutdown that has resulted in understaffed TSA checkpoints.

In the “Travel” section of the United app, passengers can now view security wait times for the airline’s U.S. hub airports located in Chicago, Denver, Houston, Los Angeles, New York/Newark, San Francisco, and Washington, D.C. Users will find estimated wait times for specific lanes, including standard security and TSA PreCheck, across terminals catering to United customers.

“We value the work and dedication of our TSA agents, and while many started receiving back pay earlier this week, the U.S. Department of Homeland Security shutdown persists, and travelers wish to stay updated on expected security wait times at our airports,” stated Jason Birnbaum, United’s chief information officer, in a press statement. “Our customers depend on our mobile app for all their travel requirements, and this latest feature helps them understand what to anticipate and plan their journey more effectively.”

The app is also introducing features intended for passengers with connecting flights. Travelers will now get personalized, turn-by-turn directions to their next gate, along with estimated walking durations, real-time status updates, and suggestions for longer layovers. It will also alert travelers if United can pause a plane for those with tight connections.

Additionally, the app will include automatic rebooking support. Rather than waiting in line to consult an agent or manually exploring alternatives, United’s self-service options will promptly offer travelers rebooking choices, complete with baggage-tracking information and meal and hotel vouchers if they qualify, in the event that a flight is delayed or canceled.

The app has also incorporated Apple’s “Share Item Location” feature for AirTag, enabling travelers who utilize an AirTag or other Find My network accessory to communicate their item’s location with United’s customer service team if their baggage is misplaced.

Users will also receive text alerts with real-time radar maps to inform them how severe weather in one part of the country can impact flights in another area.

Tesla promoted for over a year that “more affordable” vehicles were forthcoming, and they finally launched last October, with basic versions of the Model Y and Model 3 starting at $39,990 and $36,990, respectively. However, initial sales data reveals these new models have not significantly influenced Tesla’s overall sales performance.

On Thursday, Tesla reported it delivered 358,023 electric vehicles worldwide during the first quarter, falling short of the analyst predictions of approximately 368,000. The production was significantly higher than sales, with total output reaching 408,386 units.

This indicates Tesla delivered roughly 6% more vehicles in this year’s first quarter compared to Q1 2025, which marked the company’s weakest quarter in years. The Q1 2025 statistics were also impacted by production lines being halted for several weeks to update equipment, suggesting that Q1 2026 numbers may not represent real progress.

These sales statistics are notable for a company that had previously assured a 50% annual growth in EV sales. The disappointing first quarter positions Tesla at risk of experiencing overall sales declines for the third consecutive year, coinciding with falling profits.

Tesla is not alone in facing challenges to boost EV sales, especially within the U.S. Established automakers have retreated from — and in some cases, completely abandoned — ambitious plans for new EV launches. New entrants have faced difficulties as well. Rivian revealed Thursday morning that it delivered just over 10,000 vehicles in the first quarter, roughly the same figure it appears to report every quarter.

Rivian does have a new model on the horizon, as it is poised to begin shipping its more affordable R2 SUV, which is expected to enhance sales. The company is counting on the R2’s success right from the start, even though the least expensive variant won’t be available until late 2027.

Tesla doesn’t have a new mass-market vehicle on the brink of release. The company had been developing a lower-priced EV anticipated to be around $25,000. However, CEO Elon Musk scrapped that project to focus entirely on the “CyberCab.” Instead of the $25,000 model, Musk directed Tesla to create the pared-back Model Y and Model 3.

The only genuinely new model Tesla has introduced in the past few years is the Cybertruck. While it outsells most other all-electric trucks, it has fallen short of Tesla’s — and Musk’s — expectations for the armored EV. In the first quarter of this year, Tesla managed to sell only 16,130 “other models,” which includes the Cybertruck and the discontinued Model S and Model X.

Commonwealth Fusion Systems announced on Thursday that it will supply high-temperature superconducting magnets to Realta Fusion, marking the second in a series of agreements indicating that the company plans to heavily rely on its magnet technology in the upcoming years to generate essential revenue.

“This is the largest transaction of its kind to date for CFS,” Rick Needham, the chief commercial officer of the company, informed reporters during a call. 

Commonwealth Fusion Systems, abbreviated as CFS, has previously provided magnets for the WHAM experiment at the University of Wisconsin, where fusion startup Realta has a close collaboration. The underlying physics of WHAM supports Realta’s method for fusion energy, recognized as a magnetic mirror reactor. 

In a magnetic mirror, plasma is confined in a configuration that resembles two 2-liter soda bottles joined at the base. At each end, strong magnets push the plasma back toward the center. Milder magnets encircle the central part of the bottle shape. 

To enhance reactor power, Khosla-backed Realta would only need to enlarge the central section, and since those magnets are less potent, they are more economical. Costs per kilowatt-hour are expected to decrease as Realta’s reactors grow in scale.

CFS is also working on another type of magnetic confinement fusion known as a tokamak. In a tokamak, D-shaped magnets generate strong fields to maintain plasma in a doughnut-like configuration. Over the years, the firm has improved its magnets in the quest to generate electricity from Arc, its forthcoming commercial-scale reactor planned for Virginia.

The existence of both CFS and Realta is rooted in the magnets themselves. CFS was established in 2018 when MIT scientists discovered that a new category of commercially available high-temperature superconductors could form the basis for a feasible tokamak design. Realta was launched a few years later when physicists at the University of Wisconsin “recognized that there was a new technology, a game changer that would allow us to return to the [magnetic] mirror and take advantage of the engineering benefits that the concept offers,” said co-founder and CEO Kieran Furlong.

Along with the Realta and WHAM agreements, CFS has also granted a license for its high-temperature superconducting magnet technology to Type One Fusion, which is developing a third reactor design type referred to as a stellarator. Although this agreement does not entail CFS constructing actual magnets for the company, it could potentially lead to that in the future, Christine Dunn, CFS’ head of external communications, informed TechCrunch.

These agreements will aid CFS in recouping its investment in magnet manufacturing. The startup dedicated seven years and hundreds of millions of dollars to establish a factory capable of producing high-temperature superconducting magnets tailored to fusion-power specifications. Thus far, this investment has been directed toward building Sparc, the company’s demonstration reactor, which is not expected to activate until later this year.

“With Sparc now 70% finished, it was the perfect time to begin supporting Realta with our magnet production,” Needham stated.

Given that Realta and Type One are pursuing distinct reactor designs, CFS does not currently view them as direct competitors. In the marketplace, Realta and CFS are even further apart, with the former initially concentrating on industrial applications requiring substantial amounts of heat.

To date, CFS has secured nearly $3 billion — a significant portion of all venture capital raised by fusion startups. This positions the company advantageously, granting it the resources to construct essential facilities such as its magnet factory ahead of its rivals. The startup promotes these deals as a service to the broader fusion sector, providing access to technologies that would cost millions to recreate. This is certainly valid, but it also enables access to even more venture funding, albeit indirectly.

Update 1:45 pm ET: CFS’s manufacturing facility produces HTS magnets, not tape, and it will remain operational, creating additional magnets for Sparc. The article also inaccurately identified Rick Needham’s position as COO; he is CCO.

Startups frequently proclaim their commitment to diversity but tend to be sluggish in establishing hiring practices that embody this value. For a growth-stage company, it is often easier to recruit from established Silicon Valley networks, yet if a founder aims for a varied team, that principle must be enacted from the very first hire. 

Leah Solivan, who founded Taskrabbit and is the founder and managing director of Precedent.VC, engaged in a conversation with Isabelle Johannessen on Build Mode about their approach to hiring while at the helm of Taskrabbit. As the company transitioned from being self-funded through Solivan’s personal credit to one of the leading platforms of the gig economy, the leadership team consciously pursued diverse talent for every position.

Diversity is not a mere coincidence. Solivan and their team embedded it into all facets of their recruitment and hiring practices. “If you initiate this from the outset, it simplifies the process because the culture developed, the team assembled, and the network established as a corporation are inherently more diverse, creating a self-sustaining system. Waiting until you’ve scaled and reached the end stage is too late,” stated Solivan.

Every startup has a talent network with the founder at its nucleus, which logically means the network will mirror the founder’s community. Thus, a more diversified tech sector largely starts with who invests in these founders. As an early-stage investor, Solivan has witnessed the financial dynamics from both ends of the spectrum. 

“Tracing the money through the ecosystem reveals it originates from limited partners, who determine the recipients of funding—venture capitalists. Subsequently, the venture capitalists select the founders they choose to invest in,“ explained Solivan. “While the funds are available, they are managed by individuals with varying biases.”

Nonetheless, neither a founder nor their venture capital backers need to be underrepresented to deliberately hire from a diverse talent pool. Solivan advocates for aiming to review two female candidates’ résumés for every male résumé, broadening the range of networks tapped into, and promoting individuals from diverse backgrounds into leadership positions.

“You’re inviting someone to leap off a cliff — let’s create a safety net for them to land in,” remarked Solivan.

Apply to Startup Battlefield: We seek early-stage companies with an MVP. Nominate a founder (or yourself). Be sure to mention you learned about Startup Battlefield from the Build Mode podcast. Apply here.

TechCrunch Disrupt 2026: Join us again for TechCrunch Disrupt from October 13 to 15 in San Francisco, featuring the Startup Battlefield 200. If you want to support them or connect with thousands of founders, VCs, and tech enthusiasts, be sure to get your tickets.  

New episodes of Build Mode are released every Thursday. Hosted by Isabelle Johannessen. Produced and edited by Maggie Nye. Audience development led by Morgan Little. Special thanks to the Foundry and Cheddar video teams. 

Newsletter service Beehiiv has announced the launch of its native podcast hosting feature, as reported exclusively by TechCrunch. This development allows creators to host, distribute, and monetize their podcasts directly within the Beehiiv platform. Users will have the ability to publish episodes, share them with their audience, and monitor their analytics all in one place.

“Entering the podcasting space was a natural progression,” commented Tyler Denk, co-founder and CEO of Beehiiv, in an email to TechCrunch. “At a fundamental level, newsletters and podcasts have significant overlap. Both formats generally consist of episodic, long-form content delivered to a dedicated audience and monetized through sponsorship. Our future direction is greatly influenced by our users. They’ve expressed a strong desire to centralize their tools within Beehiiv, with podcasting being asked for repeatedly by users of all types.”

Denk indicates that Beehiiv currently has numerous users who host their podcasts on other platforms, making it logical to bring the service in-house. This initiative further illustrates Beehiiv’s commitment to transforming its platform into a comprehensive hub for creators, competing directly with Patreon and Substack, both of which have endorsed podcasts for a long time. The expansion into podcasting builds on the company’s recent rollout of a toolkit focused on creators, encompassing website creation, analytics, and more.

By stepping into the podcasting arena, Beehiiv seeks to draw creators to its platform, especially as its competitors adopt similar approaches. Substack has actively engaged with video and podcast creators, while Patreon has sought to attract newsletter authors with much-anticipated feature enhancements.

Semafor previously reported on Beehiiv’s efforts to enter the podcasting domain.

One strategy Beehiiv is utilizing to encourage creators to transition from competitors like Substack and Patreon is by not taking a cut from their earnings. Denk states that creators retain 100% of their income, with the company not claiming any share. In contrast, Substack takes a 10% cut from revenue generated by paid podcast subscriptions, while Patreon takes 8%. 

Creators have the ability to bundle their podcasts with existing subscriptions and offer a private feed to paying subscribers. They can provide a premium experience featuring exclusive episodes, early access, and additional benefits. Denk points out that many existing Beehiiv users charge for a paid newsletter and can now include a podcast in that subscription. Creators also have the option to offer their podcasts for free.

Beehiiv intends to broaden its advertising network beyond newsletters to also dynamically serve advertisements within podcasts. The company is in the process of hiring a head of Podcasts to oversee this initiative, according to Denk’s statements to TechCrunch.

Among the podcasts launching on Beehiiv are Genshe with Avni Barman, 505 podcast featuring Brayden Figueroa and Kostas Garcia, The Rebooting Show with Brian Morrissey, Sweat Equity by Alex Garcia and Brian Blum, The Most Important Question from Dr. Katelyn Jetelina, Lunch with Jamie by Jamie Patricof, and several others. 

Denk anticipates significant adoption from current users in the upcoming weeks and months, highlighting that several additional notable podcasts have pledged to debut on the platform shortly.

In addition to catering to individuals on Beehiiv who already possess newsletters and podcasts, Denk states that the new feature could also attract podcasters looking to start a newsletter.

“We are convinced that a newsletter should serve as a fundamental piece of infrastructure for any podcast,” Denk said. “It’s essential for audience ownership, expanding distribution, and generating more opportunities for advertisers. Podcasters aiming to initiate a newsletter will discover a natural fit here. Growth remains one of the largest hurdles in podcasting. Newsletters bolster podcast downloads, while podcasts enhance newsletter subscriptions. The two processes support one another, and at present, creators are managing that across disparate tools. We’re addressing that.”

Creators can directly upload their podcasts to Beehiiv, and the platform will subsequently distribute them to major podcast channels such as Apple Podcasts, Spotify, Overcast, Castro, and more. The platform accepts MP3, M4A, and WAV files and features automatic audio normalization to ensure consistent audio quality. Each episode comes with a complete transcript, enhancing search and LLM discoverability. 

Each episode of the podcast receives its own SEO-optimized web page, noted Denk. Instead of directing listeners to Apple, Spotify, or YouTube, Beehiiv allows them to remain on the platform where they can opt to listen directly or select their preferred player. 

Beehiiv’s podcast analytics adhere to IAB standards and provide comprehensive breakdowns by country, listening application, device, and operating system. Creators also receive insights into downloads at the episode level and access real-time data. 

Founded in 2021, Beehiiv last secured $33 million in a Series B round in April 2024, with Lightspeed Venture Partners and NEA among the investors. Denk recently mentioned that Q1 2026 marked Beehiiv’s most successful quarter to date, as the company added $4.5 million in ARR, sent over 10 billion emails, and surpassed 50,000 active users.

Updated to reflect previous reporting on Beehiiv’s podcasting initiatives.

Cash App, the peer-to-peer financial technology application owned by Jack Dorsey’s Block, has introduced a new “pay-over-time” deferred payment option enabling qualifying users to spread their everyday transfers over an extended timeframe.

More companies are increasingly providing deferred payment options for standard and routine purchases. Approximately a year ago, DoorDash collaborated with Klarna—enabling users to “micro-finance” their meal orders (the collaboration notably led to a wave of online humor about “burrito debt” and late capitalism). Cash App’s latest feature clearly capitalizes on this trend—broadening convenient financing into the P2P payment sector.

To benefit from this new feature, users incur a 7.5% fee—indicating that if you borrow $100 from Cash App, your repayment to the company will total $107.50. The company states transfers of $25 or more qualify, with repayments possible in weekly installments over up to six weeks or as a lump sum on the due date.

There are also loan thresholds in the new system, which are variable—implying they will differ among various users. “The precise amount eligible for conversion depends on the initial transaction amount and customer assessment,” a representative stated. “We assess each transaction for eligibility according to our responsible lending standards rather than establishing conventional credit thresholds,” they further noted.

In a discussion, Block’s Executive Officer and Head of Business, Owen Jennings, positioned the new feature as a method to enhance value for Cash App users through “cash flow management.” Jennings pointed out that numerous Americans today have different types of jobs—many of which pay with less regularity than those available in earlier decades. The aim of Cash App’s new feature is to provide financial adaptability to these circumstances, Jennings explained.

“We’re observing a growing number of individuals—especially younger ones—who are solo-preneurs, entrepreneurs… [and] gig workers. They engage in side hustles, juggling multiple positions, [and] thus possess fluctuating income sources,” Jennings stated. “This significantly contrasts with the situation 40 or 50 years ago—where the average income earner in the U.S. was typically receiving a regular W2 income biweekly.”

“Buy now, pay later” solutions have surged in popularity in recent years while also provoking major criticism and concern. Some critics argue that such services are constructed to ensnare consumers in continual debt cycles, whereas others imply that Americans’ need to finance basic household goods signifies a broader economic crisis. Firms offering these services have similarly encountered legal issues. Just this week, Klarna faced a class-action lawsuit alleging it engaged in “predatory” practices, according to Bloomberg.

Jennings mentioned that Cash App’s new feature includes robust built-in safeguards designed to keep users from falling into financial difficulties, such as being caught in what he termed “debt spirals.” “All of our lending products are designed to be non-revolving,” he remarked. “If you fail to repay a loan, you will not be able to obtain another loan.”

The service also leverages existing financial flexibility features that Cash App already provides, Jennings noted. In previous years, the app launched Borrow, which similarly to a conventional bank, enables users to secure a small loan from the app and repay it over a period of four to six weeks.

Another offering is Afterpay for Cash App Card (its debit program), which permits users to postpone payments for transactions made using the card.