Yeah, that... I feel really bad for anyone who trusted and implemented it. The sheer level of exposure with that was mind-blowing. I mean, an endpoint you could hit and just... Get all the API keys?

For anyone who doesn't know, this write-up is a good one: https://gigcitygeek.com/2026/03/08/huntarr-api-security-risk/

Long story short, a vibe-coded security nightmare for anyone foolish enough to trust it.