This doesn't really even seem like much of a disclosure to be had. The system is mostly open without authentication, and what little auth exists is behind a tri

This doesn't really even seem like much of a disclosure to be had. The system is mostly open without authentication, and what little auth exists is behind a trivial-to-break password. I mean hell, the main "hack" is looking at the API calls.