It seemed to me like they actually got explicit consent to have guest permissions to view this information, I am honestly pleasantly surprised. Once I saw them

It seemed to me like they actually got explicit consent to have guest permissions to view this information, I am honestly pleasantly surprised. Once I saw them looking at the security tokens I got worried, but they pulled it out of a tailspin pretty quick. > Because we can’t instruct students to copy-and-paste the URL (and thus their session key), we needed another way to access students’ transaction history. We turned our attention to JumboCash’s guest access feature. I am going to take "can't" as "were not willing to" which is more impressive. It sounds like they could pretty easily have convinced people to give them a lot more access than they realized, and chose not to go that route.