I'm not sure what is worse, the bad API/app design, or the blog post publicly sharing how to abuse it...