Interview Coder Data Leak: What the PDF Redaction Failure Reveals

Introduction

Interview Coder, the AI cheating tool that promises “completely anonymous, invisible to detection” technical-interview assistance, just leaked its own users. Not via a dark-web breach or a SQL-injection drama — they posted the data themselves on the homepage of their website, in a new feature they called the Offer Gallery.

The redactions on those offer letters were trivially bypassable. Select-and-copy any portion of the PDFs they uploaded and the supposedly hidden text — full names, comp packages, offer locations, hiring company — copies right out. Anyone with a keyboard and ten minutes can dox the “trusted by 97,000 devs” users this product claims to protect.

📚 Table of contents

What Interview Coder is

Interview Coder is a paid platform (around $600–$799 depending on plan) that runs an AI assistant during live technical interviews. The pitch is invisible AI assistance — the tool surfaces answers to interviewer questions while remaining undetected by the candidate’s screen-share or proctoring software.

Its founder, Roy Lee, has publicly bragged about Interview Coder reaching multi-million-dollar annual revenue. He’s also been the subject of prior coverage for being expelled from his university for using AI cheating tools.

What the Offer Gallery shipped

The promo tweet read: “Today we shipped an Offer Gallery. Real offers from real users.” The page displayed scans of formal offer letters from companies like Amazon, Apple, and Microsoft, with personal details (names, dates, comp numbers, locations) ostensibly redacted by black boxes drawn over the PDFs.

The redactions are visual overlays, not actual text removal. The underlying PDF text remains intact beneath the black boxes — this is one of the oldest mistakes in document redaction. PDFs store text as a separate layer from the rendered image, so any visual mask leaves the source text extractable through normal copy-paste, programmatic parsing, or a PDF reader’s text-search function.

How the redaction failed

The exposure path is comically simple:

1. Open the Offer Gallery on the Interview Coder homepage.
2. Click into any offer letter.
3. Click and drag to select a black-boxed region of the PDF.
4. Copy. Paste into a text editor.
5. The redacted text appears.

Repeating this across the gallery surfaces multiple users’ full names, exact compensation breakdowns including restricted stock unit totals, office locations, employer names, and signing dates. Demonstrations of the leak are already circulating on YouTube and on Twitter.

Why this is worse than a regular breach

Most data breaches are unwanted. A user signs up, expects their data to be private, an attacker steals it. That’s bad but at least the user’s consent boundary is intact.

This is the operator volunteering users’ data as marketing material, then failing to redact it. The legal exposure is different, the trust violation is different, and the downstream consequences are worse — the data is on the company’s own homepage, indexed by search engines, screenshottable forever.

For a service whose entire value proposition is anonymity (“completely anonymous, invisible to detection, undetectable”), this isn’t just a security failure — it’s a contradiction of the product’s reason to exist.

Their previous security incident

This isn’t the first time Interview Coder has shipped a security own-goal. Earlier in 2025, they pushed API keys to a public GitHub repository — the kind of mistake that fails a security 101 lecture. The pattern is consistent: a product marketing invisibility while the operators ship visible mistakes.

What to do if you used this tool

• Check the Offer Gallery for any document resembling an offer letter you submitted or sent in.
• Request immediate removal from the operator. Be specific — cite the exact URL.
• If your offer is identifiable, talk to a lawyer about what your obligations are toward the employer that issued the offer. Disclosure may matter more than concealment at this point.
• Assume the data is already cached by search engines and archived. Even if the operator removes the gallery, the leak doesn’t un-happen.
• If you have an active offer, decide whether you’d rather quietly decline it than risk discovery later.

The ethical interview-prep alternative

The longer-term lesson here isn’t just “don’t use cheating tools.” It’s that the people who reliably get into big-tech roles use a well-understood, ethical path:

• Refresh data structures and algorithms fundamentals.
• Drill 75–100 high-quality, curated problems — not 500 random LeetCode submissions.
• Do at least 4 mock interviews under realistic conditions before the real ones.
• Practice the structured response (clarifying questions → brute force → optimized solution → complexity analysis → tests).
• Show up and answer the question, with no AI listening over your shoulder.

Two or three months of focused prep delivers offers without the risk of being blacklisted from every company you’d want to work for. The compensation jump is the same; the durability is what differs.

❌ The bigger pattern

Conclusion

Interview Coder’s Offer Gallery is a clean example of why AI cheating tools fail their users eventually. The product’s value proposition is invisibility; the operators’ behavior advertises the customer base. The two are incompatible.

Whatever your stance on whether this kind of tool should exist, the practical takeaway is simple: do not entrust sensitive career data — especially evidence of how that data was generated — to platforms whose security track record consists of API keys on GitHub and PDFs with paint-over redaction.

Related reading: 5 ways AI made coding worse (and how to fix it) — how to pass technical interviews in 2026 — Claude AI review

Explore More on DevShelf

• →
  LeetCode vs YouTube vs AlgoExpert: Interview Prep Compared

  How to prepare for interviews without risky third-party tools — an honest comparison of the safe, mainstream prep options.

• →
  Defensive Python: Edge Cases and Validation

  The secure-coding habits that prevent data-leak bugs — validating inputs and handling edge cases before they reach your users.