1/ got a dm. "can you test our platform?" sure. that's my hobby. it was a govt voting platform. link dropped. frontend was gorgeous, whoever built it deserves a raise. then the engineer in me woke up.

2/ first thing i tried, vote without logging in. worked. no candidate shown to me even. just voted for whoever's name sounded sweet. don't ask.

3/ asked myself, no login, so how do they know i already voted? tried again, got blocked. cookies. cleared them. reloaded. voted again. second round secured. i laughed for this one.

4/ opened dev tools. fired a request. watched the response. PHP. not bad, i said. then i saw it, the response was leaking candidate IDs it had no business sending back. that's the door right there.

5/ now i have every ID on the ballot. not clicking a UI 100 times clearing cookies like a mumu. spun up python. automated the whole flow. fired it.