[chatmasta]

The whole point of these rewards programs is to share your data (bookings, itineraries, employment, email, travel class, etc.) with as many partners as possible. So at the end of the day, a data leak is only marginally worse than the expected behavior.

(Obviously this doesn’t lessen the impact of vulnerabilities that allow malicious actors to charge you, steal your points, amend your bookings, or access your travel data in real time. But for read-only queries, an attacker won’t get much more access than a paying partner of the program could get.)