Good find, and pretty shocking! What's the legal status of something like this? I think in the UK it would be counted as bypassing authentication and technicall

Good find, and pretty shocking! What's the legal status of something like this? I think in the UK it would be counted as bypassing authentication and technically you could be prosecuted under the CMA (happy to be corrected on that...)