I just noticed that the hackerone report curl bit includes a coinbase session cookie. Doesn't seem like a good thing to include.