This is where per-user level encryption of data should be used. If your credit report on that site is encrypted and the keys are only successfully derived by an

This is where per-user level encryption of data should be used. If your credit report on that site is encrypted and the keys are only successfully derived by answering your security questions, you've added another layer of security [1]. It also prevents the situation where a hacker gets access to the box doing the security check, and they can read everyone's data versus just those users who are concurrently asking for their reports. Even simpler, this would be prevented if /acr/oow set a decryption key as a cookie after validating the verification data that was then used by /acr/report to decrypt your credit report. [1] Yes, it's possible to enumerate over all user's security answers, so it's not perfect, but it ensures a simple mistake with an if condition, doesn't release everyone's data.