Silly me, it's even simpler. `curl -X POST -H 'Content-Type: application/json' --data '{"code": "../../.."}' 'https://example[.]com/api/auth/2fa'`

`../..?x=` as the session.userId assuming it can be manipulated and api-v1-prod.example.local returns 200 at the root. /health could be another good candidate.

I wish the note would end with "Thank you for your attention to this matter"

Hieno veto ja tyylikäs lopputulos verrattuna siihen, että kamat roskiin ja uutta kiinalaatua sisään.

🎭 Now you can create hide-my-email aliases directly in the #ProtonMail web app: proton.me/blog/hide-my... 

🖥️ The Proton Mail #macOS & #Windows apps have been released, with the #Linux app becoming available in beta: proton.me/blog/proton-... 

2 / 4

Fully agree, and should've elaborated earlier. They're effectively using regulative terminology to downplay the impact of the breach. Information leaked in the breach could subject affected people identity theft at worst.

I believe they are referring to GDPR definition of sensitive data in the statement