Yes. It was an article from someone who went into a café which had a QR code based ordering system. After ordering through the system they decide to open their

Yes. It was an article from someone who went into a café which had a QR code based ordering system. After ordering through the system they decide to open their laptop and inspect/look at the API of the system (a system apparently used across India). They realize that the whole API does not use authentication or authorization and start reverse engineering it/trying out various endpoints. They can then do things like ordering stuff for other tables, calculate earnings of restaurants, etc. They probably took it down because they disclosed it publicly directly instead of contacting that QR code based ordering service provider (which I won't mention the name of). Given that this is a substack which has a newsletter, this article has probably reached many people before being taken offline.