Popular Android messaging app Go SMS Pro has exposed millions of photos and videos, it has emerged. Cybersecurity firm Trustwave made the discovery and shared the information with TechCrunch.

Security researchers at Trustwave discovered the flaw in August and contacted the app maker with a 90-day deadline to fix the issue, as is standard practice in vulnerability disclosure to allow enough time for a fix. But after the deadline elapsed without hearing back, the researchers went public. Trustwave shared its findings with TechCrunch this week. When a Go SMS Pro user sends a photo, video or other file to someone who doesn’t have the app installed, the app uploads the file to its servers, and lets the user share a web address by text message so the recipient can see the file without installing the app. But the researchers found that these web addresses were sequential. In fact, any time a file was shared — even between app users — a web address would be generated regardless. That meant anyone who knew about the predictable web address could have cycled through millions of different web addresses to users’ files.

Apple has said that its Fitness+ service will arrive by the end of this year. MacRumors reported that the iOS 14.3 and watchOS 7.2 betas (the latest of which was released Wednesday,) indicate the service could arrive alongside those updates.

The current watchOS 7.2 beta that was released this morning has a splash screen with what’s new, and Apple Fitness+ is listed as one of the features. The first iOS 14.3 beta also had an unfinished mention of Apple Fitness+ in the Analytics portion of the Privacy settings, but it has since been removed. Given that we’re expecting iOS 14.3 and watchOS 7.2 to come out right around the beginning of December, it matches up with Apple’s late 2020 launch timeline for Fitness+.