I reported a critical bug and now they started a police investigation on me
Sigh. The old "expose the incremental primary ID of the record in the URL" thing again?!  Shouldn't this be taught as a 'no no' in WebDev 101?<p>Happens at the top of the chain too, I remember back in 1999/2000 when the Australian government released their website to enable online registration of businesses for in new GST (Goods & Services Tax), it was discovered within a day that anyone could simple trawl through the site and increment the ID at the end of the URL to view the business (and bank) details of every single one of the thousands of business that had registered.<p>In fact, IIRC, someone wrote a script that trawled through the site and obtained the information for thousands of registrants and put it into a spreadsheet which he emailed to the Australian Tax Office as his evidence.  I believe instead of being rewarded, he was reprimanded and warned for doing do.