By Epiphanus Obia
A Nigerian software engineer has exposed a critical security weakness in the National Agency for Food and Drug Administration and Control’s (NAFDAC) online product verification portal, revealing that the system lacked the basic form of input validation, meaning that a blank search, a handful of spaces, combination of random alphabets or a single emoji could bypass all checks and return real sensitive product data to anyone who tried.
The disclosure, made by Emmanuel Taiwo, a software developer who goes by the handle @ez0xai on X, sparked immediate outrage online on Wednesday, 25th March before NAFDAC quietly patched the flaw the same day, drawing applause from Taiwo himself.
What Taiwo Found
On 25 March, Taiwo posted a deceptively simple challenge on X: “If you want to see top tier engineering, go to NAFDAC verification site (registration.nafdac.gov.ng/#verify) and search using emoji or empty space. Post a screenshot of the result.”
Hundreds of users took him up on it. What they found was startling. Because the portal performed no server-side input validation (the basic programming check that ensures a query makes sense before it is passed to a database) the system would accept anything entered into the search field and return whatever it found. Users reported the system surfacing real product records, including data on expired medications, for searches that contained no meaningful input whatsoever.
From an engineering standpoint, the flaw was elementary. As one reply from developer @TrustGod_js summarised: “They need to fix the API response for unverified data. If the data is not found on the DB, return invalid or not found. Something this simple shouldn’t be an issue if they hired proper engineers.”
Taiwo explained the core problem plainly: the absence of input validation meant that anything typed into the search field was sent directly to the database without any filtering or checking. In practice, this created a scenario in which anyone — including bad actors seeking to verify the legitimacy of counterfeit products or probe the agency’s database for gaps — could extract information the portal was never designed to expose openly.
NAFDAC’s Silent Fix
Within hours of Taiwo’s post going viral, the agency patched the vulnerability. Taiwo confirmed the fix in a follow-up post: “Guys they fixed it. Well done @NafdacAgency, I guess you’re seeing my tweet.”
The rapid response, while welcome, drew mixed reactions. Several users noted that NAFDAC had been ignoring Taiwo’s earlier posts and only acted once public pressure became impossible to ignore.
“I actually thought @NafdacAgency isn’t seeing my post at all, but after this it’s 100% clear that they do — but I no know why dem dey shenk me since,” Taiwo wrote in Pidgin, before asking the agency to acknowledge his work. “@NafdacAgency, if you want to support me, you can consider donating here. I’m not your ops o.”
As of the time of publication, NAFDAC had issued no public statement acknowledging the vulnerability, the engineer who flagged it, or the nature of the fix applied.
The Broader Problem: Government Portals and the Patchwork Problem
The reaction to Taiwo’s post quickly evolved into a broader national conversation about the state of Nigerian government technology infrastructure.
One observation from @kufrearch captured a sentiment echoed widely across the thread: “Government portals be like: Version 1 built by contractor A. New features added by contractor B. Security patch by contractor C. UI redesign by contractor D. After 5–10 years you get a patchwork system.”
@MsJoy001 was blunter, she wrote: “Government be giving contract to unqualified businesses for kickback. Some government IT companies and consultants don’t even have websites.”
Meanwhile, @DETHELMAs raised perhaps the most pointed question of all: “So these guys can’t pay pen testers to fish out these kinds of vulnerability? We’re not serious in this country walai. A whole NAFDAC.”
For an agency whose core mandate is protecting the public from substandard, falsified, and expired products (including pharmaceuticals) the implications of a porous verification portal extend well beyond embarrassment. The NAFDAC product verification system exists precisely so that consumers, health workers, and pharmacists can confirm whether a product is genuine and safe. A flaw that allows arbitrary data retrieval or, worse, returns no meaningful error when a product is unverifiable, directly undermines that mission.
What Needs to Change
Cybersecurity professionals and developers who weighed in on the thread were all pointing towards the same direction for solution: investment in qualified engineering talent, mandatory penetration testing before government portals go live, and meaningful quality assurance processes that go beyond cosmetic checks.
“Employing a good QA will just solve this,” wrote @itzotuky. While that may be an oversimplification, the underlying point is that basic input validation is not an advanced security technique. It is one of the first principles taught in any web development curriculum.
For Nigeria’s digital economy ambitions — currently headlined by major government investments in infrastructure, digital public services, and the push towards a $1 trillion digital economy by 2030, the credibility of government-run digital tools is not a secondary concern, it is foundational.
The question is no longer whether the government’s portals are broken. Emmanuel Taiwo just proved that conclusively, in a tweet.