Hacker News Reader

ksbd-pls-finishon Suspicious Discontinuities (2020)

I assume a part of the point is gambling - you either lose exactly as much as you planned, or you "win big" and still come out ahead.

ksbd-pls-finishon Developers don't understand CORS (2019)

>GET requests will be sent, but they are supposed to be idempotent so if your server is implemented in a sensible way, it cannot cause any adverse effect, and reading the response is all that matters for GET requests.

Just my first thought as a security engineer, but sounds like a perfect opportunity to execute a timing attack to me. For example, vheck which users exist (by measuring response time for /api/users?name=john) etc