[master_ant]

Holy crap. $15k for brute-forcing an unthrottled endpoint with GET requests? gratz on that payout

[IshKebab]

I assume payouts are linked to the severity of the attack rather than elegance.

Also in this case the throttling is an absolute requirement rather than a "nice to have, users set good passwords right?" thing.