Provenance Record

Well-structured News piece (819 words, within the 400-1200 range). Clear Overview / What We Know / What We Don't Know / Analysis sections. Every sentence carries an inline 'according to [Outlet](url)' attribution. The closing Analysis paragraph draws a reasonable, source-supported inference (functioning intake process matters more than technical severity) rather than introducing new unsourced claims.

3 sources cited, all reachable and checked. (1) Malwarebytes (source-0.html.gz, sha256 verified against manifest: 5212817c...deba36) — read in full via gzip decompression. Confirms: app launch by Pope Francis in 2019, developer La Machi Communication for Good Causes, 719,517 registered accounts, BobDaHacker's Jan 3 2026 report to nine addresses with no response, the six-month fix delay after journalist contact, the IDOR mechanism, exposed fields (email, name, country, DOB), the validation_hash second flaw, failed email authentication, the 2019 eRosary precedent, and Decree No. DCLVII. All claims attributed to Malwarebytes in the submission match this snapshot verbatim in substance. (2) The Register (source-1.html.gz, sha256 verified against manifest: f64b5901...4e06b) — read in full. Confirms the IDOR explanation, the exact API endpoint pattern, the two BobDaHacker quotes used in the article ('You ask for your own data, the server gives it to you... Thou shalt not authorize, apparently' and 'Imagine getting an email that says...Grandma is clicking that. Every time') appear verbatim in the snapshot, the 719,517 account count, the no-rate-limiting enumeration point, and confirmation The Register reached out to the Prayer Network without reply. No misattribution or hallucinated quotes found. (3) Cyber Security News — local snapshot fetch failed with HTTP 403 (bot-blocked), file is null in manifest.json, no archive.org fallback was available. As permitted for failed snapshots, I used WebFetch as a last-resort live check of the same URL and extracted verbatim quotes: 'The exposed records included users' first and last names, email addresses, country identifiers, account-deletion status, and assigned roles,' 'The lowest-numbered accounts were reportedly associated with staff, while ordinary users were marked with the PRAYER role,' 'The information was available through a browser request...attackers would not need advanced technical skills,' and the OWASP Top 10 broken-access-control / least-privilege / default-deny language. All match the claims the submission attributes to Cyber Security News. This source's content is verified via live fetch rather than an archived snapshot; the archival failure is a technical/bot-blocking issue, not a factual discrepancy.

No fabricated or unsupported specifics found. Every number (719,517 accounts, Jan 3 2026 report date, nine contact addresses, April 30 2024 decree date, 2019 eRosary precedent) traces to a cited source. Both direct quotes are verbatim matches to The Register snapshot. No orphan URLs — the three URLs in article.sources are the same three cited throughout body_markdown (bidirectional match, consistent with the script's body_sources_match: true).

High-quality submission ready for publication as-is. The only automated flag (sources_reachable: false) reflects cybersecuritynews.com bot-blocking the snapshot fetcher, not any inaccuracy in the article — manual WebFetch verification confirms the claims attributed to that outlet are accurate. Since there is no actual factual error to disclose to readers, a corrections record would be dishonest filler rather than a genuine correction, so I am overriding the automated APPROVE_WITH_CORRECTIONS suggestion to APPROVE.