Venmo's API exposed a public transaction feed endpoint. Transactions were public by default — names, amounts, and messages could be read by anyone. The endpoint accepted pagination and had no rate limit, no daily cap, and no authentication requirement.

Security researcher Dan Salmon wrote a scraper that called the endpoint continuously for one month. His script collected 207,984,218 transactions — effectively the entire Venmo public transaction history. The dataset included real names, transaction amounts, payment messages, and timestamps.

Within the data, Salmon found patterns revealing drug transactions (payment messages used slang), personal relationships, rent arrangements, and financial dependency. He published a blog post with aggregate statistics to demonstrate the privacy implications of combining public data with no access controls.

Venmo added rate limiting to the public feed endpoint after Salmon's disclosure. However, the fundamental data privacy issue — all transactions public by default — was a separate discussion that continued for years.