So imagine this: you hit an endpoint, and instead of just leaking an IP… it somehow hands you the full street address tied to that user. Would programs treat that like a showstopper P1, or would it still get brushed off as “low impact”? Curious where the line really is here.

What do you think game-breaking or just hype?