š± White-Label Leak via iOS Update: Vendor Certificate Exposed to End Users
NAG OC
With the recent iOS 27 update, Apple Wallet now displays a full Pass Certificate view to users, which directly reveals Boomerangme to our clients and cardholders.
As shown in the attached screenshot, the certificate details explicitly expose:
- The personal developer name: "Mikhail Inishev"
- The internal Pass Type ID: pass.cards.boomerangme.app3 (showing the Boomerangme name directly)
For white-label agency partners, having Boomerangme and internal developer names visible breaks the unbranded experience and creates serious client-retention issues.
Kindly fix this issue. Thanks
Photo Viewer
View photos in a modal
L
Luis
We need this fix ASAP.
NAG OC
Mike NosovCould you please provide an estimated timeline for when this will be resolved on existing passes?
Because Apple's architecture prevents reassigning the Pass Type ID via background push updates, the only seamless path without forcing re-installs is updating the legal entity / organization name on the current certificate and š PUSH and update, and allowing us to use our own Apple ID for all future cards.
ā ļøThis is critical for an agency, it breaks our white-label and exposes our setup to clients and thousands of their active cardholders.
When can we expect this fix to be rolled out to existing cards? An update would be greatly appreciated; it's been almost 20 days since the issue was reported.
CC: Mike Inishev
NAG OC
Hi Mike Inishev, can you please give the community an update on this urgent issue? Itās been (19) days since it was first reported and itās still not fixed. We donāt blame BM for the issue, but we need a quick fix. This is the biggest whiteālabel problem Iāve seen since I joind BM in 2022. Thanks for looking into it.
SEBASTIAN
Has the problem been sorted out yet?
Daniel
Welp that just cost me $1200 ļæ½
s
sleepyhead
Daniel how come?
NAG OC
sleepyhead Personally Iāve had the same issue when BM revealed our WL ; a big company knew that I was a WL and they never signed the contract with me.
For this IOS update we canāt blame BM for it; no one saw it coming.
s
sleepyhead
NAG OC so sad to hear that, which part of the whitelabel was revealed?
NAG OC
FYI ,
I've checked the issue. The only fix is to change the name on Apple and push an update to all installed cards, BM has no other options. If they don't every customer with the card installed will need to reinstall it to see the new agency apple cert.
A platform can push background updates to existing passes only if the update is signed by the same Pass Type ID and developer team. An existing pass cannot receive a push update that reassigns it to a completely different passTypeIdentifier or a different Apple Developer Team ID.
BM needs to convert the Account to an Organization (or Rename the Legal Entity) other than Boomernagme and push an update to all cards.
Mike Nosov
NAG OC
FYI, If paying the $99/year Apple Dev. account fee resolves this, we have no issue with it. We previously faced challenges with BM revealing our white-label setup, and now having to navigate Apple's requirements adds another layer of complexity. It feels like an uphill battle just to secure a true white-label agency account. Hopefully, the BM team implements a permanent solution for this soon; we remain confident they will get it sorted out.
s
sleepyhead
NAG OC second this!
Samantha
Yes please sort this out, itās really damaging to agencies