Most people in New York City know they’re less than two weeks away from having to prove they’re vaccinated to dine or exercise indoors. Far fewer have figured out or understand exactly how they’ll show restaurants and fitness studios we’ve received all of our shots.

“I announced the Key to NYC pass and about five hours later the president of the United States endorsed it,” Mayor Bill de Blasio said on Thursday.

The NYC COVID Safe app allows users to upload a photo of their COVID-19 vaccine card and then flash the image in the app to enter a vaccine-requiring establishment.

“[It’s] not connected to the Internet,” de Blasio said. “Can’t be hacked.”

Is that true?

“No,” Surveillance Technology Oversight Project (S.T.O.P.) founder and executive director Albert Fox Cahn said. “That statement from a technical perspective just doesn’t make any sense.” Cahn read NYC COVID Safe’s terms and conditions and found the city’s app Internet-enabled to document one’s IP address every time one opens it. He also uploaded a photo of Mickey Mouse in place of his vaccine card and the app approved Mickey with three green checkmarks, leaving Cahn confused as to why the city developed its own app at all.

“The difference between vaccine cards and the app is the apps look more secure,” Cahn said, “but the truth is they’re just as easy to forge as that piece of cardboard.”

New York City’s vaccine requirement to dine or exercise indoors takes effect Monday, Aug. 16.