I Audited My Own Payment Ledger Like It Held Real Money. The Front Door Was Wide Open.

The accounting math was bulletproof. Then I asked a harder question: what could someone do if they could just reach the API? The answer was, unfortunately, everything.