BlogOne endpoint, thousands of schoolsA single misconfigured API route exposed student data across thousands of schools. Here's how I found it.