What I mean is: you knew it worked before you went and pulled more data, you could have stopped after the first two records, why pull more than you needed to prove that it was possible?
We retrieved only enough data to determine whether it was privacy-sensitive, which could not be reliably assessed from just two records. We did not download any more than that.
Supabase tables also use pagination, and we never downloaded more than the first page.
You probably should not have done that. It's one thing to determine that a hole exists, an entirely different one to exploit it to the point that you can do damage assessment on the target.
I may not be the intended audience, but as the author of a similar system having a benchmark like this of what user behavior can result in when it’s unconstrained is helpful for my safety evals. So in an indirect way, you’re making future platforms more secure by sharing this.
Supabase tables also use pagination, and we never downloaded more than the first page.