Anyone, Please Interact: Two APIs That Never Asked Who I Was
Two penetration tests, two APIs that never checked. One handed HIPAA-protected medical records to the open internet. The other let anyone pull live card data from an app the bank swore was still in development. Same bug, two costumes.