erikeng.se
Changing pickup location for someone else's parcel at Instabox
In December 2020, parcel IDs were a two-character sender prefix plus a counter, and the page for changing a pickup location treated the ID as the only credential. Anyone willing to count could move someone else’s parcel, and an unauthenticated API returned the recipient’s street address for the same ID. The critical parts were fixed in under a week; rate limiting and CORS were still open when the thread ended.