0day vulnerability full disclosure: American Express
They knew this was open. They even took it out of their robots.txt :)<p><a href="https://www.americanexpress.com/robots.txt" rel="nofollow">https://www.americanexpress.com/robots.txt</a><p>User-agent: *
Disallow: /us/admin/
Disallow: /us/heroes/
Allow: