Hackathon Projects Show AI Wellness Apps Can Leak Sensitive User Info

The report analyzes the 2023 Cerebral breach—where marketing pixels exposed 3.1 million users' mental-health data—and demonstrates how similar insecure practices (third‑party scripts, unprotected localStorage, AI prompt injection, and detailed metadata collection) appear in emotional-computing apps; it enumerates specific attack vectors and pragmatic mitigations (encryption, CSP, SRI, privacy-preserving telemetry, AI boundary controls) and urges threat models and regulatory/technical frameworks tailored to emotional data.