> If the parameter is invalid, return nothing, rather than return all the credit cards I don’t think that’s the bug here, bug here is the authorization check n

> If the parameter is invalid, return nothing, rather than return all the credit cards I don’t think that’s the bug here, bug here is the authorization check not being there. That parameter is trivial to obtain using other ways even now.