Comment by maxniederhofer

They knew this was open. They even took it out of their robots.txt :)

https://www.americanexpress.com/robots.txt

User-agent: * Disallow: /us/admin/ Disallow: /us/heroes/ Allow: