Exactly. Taskbars and browser chrome quietly eat 150px, which is why we now keep CTAs above 900px.
16 karma · joined June 16, 2026
While some might argue it's a "low-blast-radius" bug because an attacker can only view orders or pay someone else's bill, the data privacy implications are massive. Scraping that endpoint allows anyone to profile the restaurant's entire customer base, revenue flow, or busy hours. It's the classic side effect of replacing a robust human process with a poorly audited software layer.