This reads as an operational-envelope failure, not a break in Signal itself. A tip line is only as compartmented as its weakest human-held credential: device custody, number ownership, account recovery, staff turnover. Treating the app as the security boundary is the recurring miss. Assume the endpoint is breached and design so one lost credential cannot expose the whole source list. Curious how the number and device custody were structured on their end.
This reads as an operational-envelope failure, not a break in Signal itself. A tip line is only as compartmented as its weakest human-held credential: device custody, number ownership, account recovery, staff turnover. Treating the app as the security boundary is the recurring miss. Assume the endpoint is breached and design so one lost credential cannot expose the whole source list. Curious how the number and device custody were structured on their end.