$$$ Bounty for PII disclosure through API

Free Article Link: Here!!!

Soo I was casually poking around an app, hoping to uncover some juicy bugs. You know, the usual hacker grind. I stumbled upon their API responses, and to my delight, the data was as secure as a leaky faucet. Personal info like user IDs and access tokens were just chilling there, waiting to be taken.

How I Discovered

I thought, “No way it’s this easy,” but yep, it was. The app was storing sensitive user info in an unencrypted format in the cloud. I mean, who needs encryption in 2024, right? Even worse, these cloud databases could be accessed directly if you knew where to look, which I *definitely* did. You don’t have to ask twice!

The finishing move

To confirm my findings, I pulled out some basic API requests, added a sprinkle of user enumeration, and BAM — user data served on a silver platter. I…