What happens when a "fix" makes a vulnerability harder to see, not gone?

A Fix That Hides a Flaw Isn't a Fix Here's what's actually happening: when the government's response to a security disclosure is examined, the real story isn't that UMANG had vulnerabilities - most large digital systems eventually do.

The real story is what "fixing" it actually meant and what that reveals about how a system built for convenience handles risk. The Mechanism That Actually Broke UMANG works as an aggregator - a single portal that talks to hundreds of separate government databases (EPFO, LPG providers, Aadhaar-linked services) on a citizen's behalf, through APIs, which are essentially the messaging channels software systems use to request and hand over data.

The researchers found the problem wasn't in one weak API - it was structural. As one researcher put it, "almost everything is broken by design." That distinction matters: a single broken door can be locked. An architecture where the doors were never built to be secure has to be rebuilt, not patched.

When the IT Ministry responded, it encrypted APIs that had been sending data in plain text. That sounds like a fix. But according to the independent reviewer who examined it afterward, the encryption used was weak enough to be cracked with a simple workaround - meaning the flaw wasn't closed, it was made less visible.

That's the difference between security and obscurity: one makes the door harder to open, the other just paints it so you can't see the hinges. Why Centralisation Raises the Stakes The EPFO module alone recorded over 40 crore transactions in three months.

When a single portal aggregates that much traffic across thousands of services, a flaw in the shared architecture doesn't expose one database - it potentially exposes all of them at once. That's the trade-off centralised e-governance always makes: enormous convenience, concentrated in a single point of failure.

UMANG didn't create this trade-off; it's inherent to any "one app for everything" model. But this disclosure shows what happens when the underlying plumbing isn't held to the same rigour as the interface built on top of it.

Where India Actually Stands India has built one of the world's largest digital governance stacks and UMANG is central to it. That scale is real and internationally notable. What this episode reveals is a gap between deploying digital infrastructure fast and securing it with matching seriousness - a gap that shows up specifically at the moment a flaw is disclosed and the fix has to actually close it, not just quiet it.

For the exam, the sharper insight isn't "government portal had a bug." It's that centralisation multiplies the consequence of any single architectural weakness and a response that merely obscures a flaw rather than eliminating it leaves the actual risk untouched - just less visible to the next researcher who goes looking.