A name in a notification is a claim about who is talking. When the row says Folcadi Support , most people read it as the app speaking, not as a stranger who picked a good title. That is the whole attack: cheap to set up, impossible to explain afterwards.

This is the story of closing that gap in Folcadi, a language-exchange messenger. It covers the three holes that made impersonation possible, the one shared module that now closes them, and the design decision that followed: a reserved name is the official channel, and an official channel behaves differently from a normal group.

Three ways to look official

The app already had a reserved-name list for user handles. Group names had none. That asymmetry was the bug.

Three separate holes, each enough on its own:

Group names were unprotected. Anyone could create a group called "Folcadi" or "Folcadi Support". It would appear in other people's chat lists, and the invite push would read "Added to group: Folcadi".…