Here is a reminder for all US citizens.

Your social security number is simply a serial number with zero checksums or any logic built in.

If you want another valid social security number you can simply pick a number before or after your own.

The social security number was never designed to be a general ID number, and should not be used as such.

001-05-1120 was the number on the fake SS cards that used to be the inserts in wallets that had a clear plastic window for your ID. It is actually a number that the SSA set aside for advertising.

I use it where any business requires a SS number to get services.

"secret question"

yup, that looks about 20y out of date

Perfect thing to mention at the interview

This is CWE-204, there are loads of big companies that don't care about this. Netflix is one of them where you can enumerate registered users email addresses from the login screen.

If you want to report this to them you can check if they have a security.txt file at https://domainhere/.well-known/security.txt where they should list the contacts to their security team.

Never give any info in a security error. Just say there was an error. Goes right along with the rule to sanitize any and all input. Trust no one and nothing.

Depends on the size of the agency. You can already guess a SSN based on the range of numbers used. If you were targeting the youngest or oldest person at a small agency you could probably get a high percent chance of getting a match.