Relay - delivery company, security concerns

[RoadToad84]

Please move if this isn't the appropriate section.

I've recently sold a couple of items on Vinted that have needed to be sent by Relay (a seemingly new company that has popped up). The process itself works fine, however I've noticed that I am able to access the buyer's tracking information by using ANY postcode, giving me access to their own address, delivery instructions, and Safe Place details.

I'm fairly sure this is a breach of GDPR at the least. I have dropped them an email to make them aware, in case it's a bug that's not been spotted, but is there anything further I can do?

[.:ian:.]

As the seller dont you know their address anyway? What am I missing?

[JoshSm]

I think it's that accessing the extended tracking info that should require the number *and* the postcode is accessible with just the number, as the postcode validation passes regardless.

Which is a hole, as it's open to anyone who has the tracking number.

[RoadToad84]

.:ian:. said:

As the seller dont you know their address anyway? What am I missing?

Through platforms like Vinted and possibly eBay, the buyer tends to choose shipping provider and does not generally disclose their address as it's often hidden behind anonymous QR codes and label-free shipping.

But as the poster above states, currently anyone with the tracking number can fully access the buyers personal details

[808 Estate]

On ebay you get the buyers details as otherwise you cant post it.

[JoshSm]

808 Estate said:

On ebay you get the buyers details as otherwise you cant post it.

But if you go on a courier site (Royal Mail or any of the others) and check the tracking against the number on the public interface, you can't usually get an actual destination address or extended delivery options out without putting in the matching postcode too. It's a sort of 2FA.


Obviously anyone sending something will know an address, but this sounds like a leak where there shouldn't be one.

Given how new and tech centered Relay are they probably vibe coded it all and there's not really any working check, just a mockup.