To save anyone a click, the author figured that AirBnB's urls had monotonically increasing numeric ids, which is the Rails default, and figured out that the AirBnB CEO's id was 3, and got the direct link before it was shared publicly.