“Order IDs are sequential, meaning you can keep adding 1 to the number to get the details of the next order, and in turn get even more user information.”
McDelivery India has more than 10 million downloads on Google Play. A guest token and sequential IDs exposed any order, any invoice, and the live location, phone number and plate of any driver. One PUT request let a user set his own price, and the server signed it. The 24-page report covering all of it earned a $240 Amazon gift card.