“There wasn’t any server-side limit to the length of a recording name.”
Blocking someone in YouTube live chat exposed their Google account ID. Pixel Recorder turned that ID into an email address. A 2.5 million character recording title stopped Google from notifying the target. Google first patched the wrong half and paid $3,133 before the total reached $10,633.