$ cat writeup.md…
$ cat writeup.md…
hackadvisor
Task: Developer networking platform with public profiles and JSON API. Solution: Discovered IDOR in /api/users/{id}/profile endpoint that returns private data (including admin's private_notes with flag) without authorization check, while web interface properly filters sensitive fields.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar