TWITCH SHIPS SERVER-SIDE EPPO KEYS IN ITS IOS APP, EXPOSING ITS ENTIRE PRODUCT ROADMAP

Summary from the TLDR InfoSec newsletter

Twitch's iOS app uses server-side Eppo SDK keys instead of client tokens, exposing over 260 unobfuscated production feature flags via a CDN endpoint that can be freely polled once a key is observed in traffic. The flags reveal Twitch's near-term roadmap. Hardcoded IDs, internal codenames, and future launches like “Elevate Prime 2026” are visible, turning feature flags into a live intelligence feed on product, security posture, and internal economics.