zenpe
Joined 4 months ago
Karma
16
Submissions
14
Member since
Jun 16
https://screensize.net
View on Hacker NewsJoined 4 months ago
While some might argue it's a "low-blast-radius" bug because an attacker can only view orders or pay someone else's bill, the data privacy implications are massive. Scraping that endpoint allows anyone to profile the restaurant's entire customer base, revenue flow, or busy hours. It's the classic side effect of replacing a robust human process with a poorly audited software layer.