No authentication on a pipeline of four calls.
- A street query returned move history for about twenty years: apartment numbers, move-in and move-out, an active flag. One request, on the order of ten thousand rows.
- A GraphQL filter by postal code, not exposed in the product UI, returned every registered person in that code. Alias batching multiplied it in one HTTP call.
- The person page's server render included the phone number, exact coordinates, and household fields, including birthdates the UI masks.
- A public reminder endpoint returned created for any person id plus a phone number. No rate limit. The message is an SMS or an app notification.
What we proved
An unauthenticated caller can pick a street or a postal code, enrich to a current phone and a point, and send that person a message. About two requests per person. The directory covers a national population, on the order of ten million residents.
What this is not
People-search products publish some of this by design. The report is not "the directory exists." It is bulk export with no auth, a selector the UI never shows, fields in the HTML that the page pretends to hide, and a notify call that turns the dataset into contact.
Why a scanner misses it
Each piece looks like a public API. The risk is the chain. The masked-versus-rendered check is a read of the HTML, not a CVE.
Buyer takeaway: If the frontend hides a field behind a click, assume the HTML already has it. A reminder endpoint is a messaging channel. Put a session and a rate limit on it.
