Reverse engineering Lyft bikes for fun (and profit?)

https://ilanbigio.com/blog/lyft-bikes.html

Reverse engineering Lyft bikes for fun (and profit?)

This article details the author's journey in reverse engineering Lyft's bike-sharing service (BayWheels, formerly Ford GoBikes) in 2019. Driven by frustration over bike availability, the author used Charles Proxy to capture and decrypt iOS app traffic, allowing them to understand the API requests for unlocking bikes. They then developed a Python script to bypass the geofence and brute-force bike IDs, eventually discovering a race condition that allowed unlocking two bikes for the price of one. The author responsibly disclosed these vulnerabilities to Lyft through HackerOne, receiving a $500 bounty, and the issues were subsequently patched.

by Ilan Bigio · 12 min · 9.2.2026

Note

i enjoy these write-ups.

they help make a seemingly difficult expert level task seem much more within reach.

Link

https://ilanbigio.com/blog/lyft-bikes.html

Published

2026

Summary

This article details the author's journey in reverse engineering Lyft's bike-sharing service (BayWheels, formerly Ford GoBikes) in 2019. Driven by frustration over bike availability, the author used Charles Proxy to capture and decrypt iOS app traffic, allowing them to understand the API requests for unlocking bikes. They then developed a Python script to bypass the geofence and brute-force bike IDs, eventually discovering a race condition that allowed unlocking two bikes for the price of one. The author responsibly disclosed these vulnerabilities to Lyft through HackerOne, receiving a $500 bounty, and the issues were subsequently patched.
#lyft bikes#baywheels#ford gobikes#reverse engineering#api#ssl proxying#charles proxy#geofence bypass#brute-force#bike id#vulnerability disclosure#hackerone#cybersecurity#ethical hacking