> 1. They haven't disclosed anything of use to an attacker. I also don't believe this is "responsible" disclosure, but I also don't think it's fair to say this

> 1. They haven't disclosed anything of use to an attacker. I also don't believe this is "responsible" disclosure, but I also don't think it's fair to say this information is of no use. To me this clearly signifies that there is no back-end authentication on their API. The whole app is probably written in JS with a simple database on the backside with no serious middleware on the server side. It would probably not be difficult to reverse engineer this hack by monitoring requests using simple dev tools, and then simply replaying them with altered content.