Free link 🎈

Hey there!😁

It all started with coffee. ☕
Like every bug hunter, I told myself “I’ll just check one more domain before bed”… and then it was 4:37 AM, I had 37 Chrome tabs open, my coffee was cold, and my cat was giving me that “go to sleep, you idiot” stare. 🐈

But what I stumbled upon that night was worth every drop of caffeine-induced anxiety.
Let me take you through how a seemingly harmless GraphQL debug endpoint decided to go full drama mode and hand me their entire database.

I was running my usual recon workflow:

subfinder -d target.com -silent | httpx -silent -mc 200

One subdomain stood out:

debug-api.target.com