I’m not 100% sure but the first thought I had when reading it are the SPA routers that start with # by default? I only read it on my phone without following al

I’m not 100% sure but the first thought I had when reading it are the SPA routers that start with # by default? I only read it on my phone without following along but if that’s the case then the text seems to hint at potentially brute forcing the authentication tokens? At least judging from the variable names.