2 ms·
The 'customers' could be free tier users - a social media type system where everyone has a public profile - intended for the public - would still be scrapable b
by mgkimsal 2y ago
The 'customers' could be free tier users - a social media type system where everyone has a public profile - intended for the public - would still be scrapable by /profile/1, profile/2, etc. Doesn't necessarily require 'authentication' for the exposing of sequential integers to have a bad outcome.
- throwaway8486k 2y agoYou're right. The urls were public to be shared (think of marketing material / ecommerce), so there was not a security incident. But it did give our competitor free highly qualified leads that they could use to poach customers. This product was new to our customers, and we had spent a lot of time selling and convincing them that it was useful.