“Call metadata might seem harmless, but in the wrong hands, it becomes a powerful surveillance tool.”
Verizon’s Call Filter API returned the incoming call history of any Verizon number to anyone who asked. The server never checked the requested number against the user’s token. The endpoint ran on a third-party vendor’s servers. Abuse survivors and police officers had their call logs open.