The tl;dr of the vulnerability is this: the Box sync application had sensitive information (e.g. application secret keys) exposed. Fairly widespread problem, w

The tl;dr of the vulnerability is this: the Box sync application had sensitive information (e.g. application secret keys) exposed. Fairly widespread problem, which is almost inevitable given enough binary digging and reverse engineering work, unless you do real work to segregate the authentication process to a serverside PKI or something similar. If the author comes across this, good work, nice writeup! However, if you're going to have a tl;dr section at all, you should put a brief description of the vulnerability in it. In this case, the vulnerability is simple enough that it can be briefly expressed in a tl;dr.