I discovered that changing a few headers gives you full access to the private/internal API used by the mobile app of a pretty massive website.

The biggest WTF is you have to send a Bearer Token but the value isn't checked.

So many cool things you can discover with Charles