[drivebyacct2]

What exactly was exposed here. It looks like it's been blocked now...

Just stealing from other bit in this thread: somehow these urls got on the Internet even though they shouldn't have. They are pre-authed urls that auto-login and then expire.

[runn1ng]

Seconding this... I see just ordinary account numbers from here.

[notatoad]

Still exposed here - when you click a link, it pre-fills the login box with a users email. And I guess some of the links include auto-login tokens.

[runn1ng]

Oh, OK. I can see the mails too, I just didn't think it's such a security risk.