I discovered that changing a few headers gives you full access to the private/internal API used by the mobile app of a pretty massive website. The biggest WTF

I discovered that changing a few headers gives you full access to the private/internal API used by the mobile app of a pretty massive website. The biggest WTF is you have to send a Bearer Token but the value isn't checked. So many cool things you can discover with Charles