IDOR Fallout: Leaking 2 Million Sensitive Files with a Simple Trick

When you see a public bug bounty program that has been running for over a decade, the assumption is usually that it's been picked completely clean. Every obvious endpoint has been hammered, and every