Hacker News Reader

sorry if this is trivial, but how easy is it to get the Mobile API access token? I thought api access tokens should be safeguarded like credentials

You didn't need the target's access token. Your own worked just fine.

Exactly, that in itself is the whole point of this being a security bug.

Woah, didn't catch that when I first skimmed through the article. $12,500 wasn't enough then.