Anyone who has been cursed with using anything related to CarWings might not be surprised by this. I swear their backend is running on some intern&#x27;s personal laptop. That feature where you can preheat your car from your phone? Be sure to allow a few minutes to do that. Start the app, wait 30 seconds for it to log in. Go to &quot;Climate&quot;. Oh, shoot, it thinks the heat&#x27;s still on (the app does a pathetic job of managing state). Click &quot;Turn Off&quot;. Wait another 30 seconds (or more) while it round-trips to the car. Click &quot;Turn On&quot;. Wait another 30 seconds. Go to car, expecting it to be warm. Open car door to discover that it&#x27;s stone cold.<p>That&#x27;s just one example.  Nissan said they&#x27;d charge for CarWings after three years. Going on almost five years later, we&#x27;ve yet to receive a bill. Nissan knows if they tried to charge for CarWings, they&#x27;d have three paying customers because no one else would pay for that crap.<p>With all its warts, I would have said nothing much would surprise me were a security hole were found. But this is just astounding. The prior API at least required creds. So they took an API that had some modicum of security, discarded that and just use a string that&#x27;s visible from the outside of every vehicle? Picture me with my lower jaw hanging between my knee caps.