$ cat writeup.md…
$ cat writeup.md…
hackadvisor
Task: an account settings page exposed a client-controlled userId used by the API. Solution: tamper with the userId parameter to request the admin account and extract the flag from its api_key.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar