By: TechLegacy Staff Published: April 14, 2026
Because the developer used the subdomain wwwxx.[redacted].com , they failed to secure the API endpoints. Security researchers discovered that by simply changing a number in the URL ( /user/1234/taxform to /user/1235/taxform ), you could view another person’s partially completed tax return.
While the name “wwwxx” now feels like a typo or a forgotten URL shortener, in early 2018, it was a curiosity for early adopters looking to avoid bloated desktop software. But what happened to the wwwxx 2018 Tax App? And what lessons does it hold for today’s filers? In 2018, the IRS was still struggling with the aftermath of the Tax Cuts and Jobs Act (TCJA). Most major apps (TurboTax, H&R Block) were playing catch-up with the new tax brackets. Enter the wwwxx app.
As we approach another tax deadline, it is easy to forget the Wild West era of mobile tax filing. Seven years ago, in the chaotic weeks leading up to the April 2018 deadline, a niche application known simply as attempted to disrupt how freelancers and gig-economy workers filed their 1099-MISC forms.