One Extra JSON Key: How a Harmless Profile Endpoint Became an ATO Candidate

A real bug bounty lesson about mass assignment, impact proof, and learning from weak reports.