Blog

One endpoint, thousands of schools

A single misconfigured API route exposed student data across thousands of schools. Here's how I found it.

I'm in the process of writing this, I promise it'll be here soon.