Comment by Nextgrid

This is about a non-rate-limited endpoint providing ticket data given a booking code only (and not last name as it's usually the case), which makes it feasible to bruteforce the entire search space.

(unfortunately, I feel like AI was overused in authoring the writeup)