Hacker News Reader

That's not unusual for a security bug; it's not like this stopped people from using the app in a way that they'd loudly complain about or that would show up in metrics.

Given they didn't think it was exploited they must have pretty poor logging and analytics around that part of their infrastructure. Someone managed to abuse it millions of times and they didn't know about it even after they'd fixed it and knew exactly where to look for abuse.

Curious what kind of logs/analytics would you add and watch to catch something like this?

You should notice a spike in any request logging metric if someone exploits this.

Depends on the normal usage, if someone was doing this across unique ips and slow enough that the usage change may be say 1% it wouldn't be noticed.

A more sophisticated system that could look at the ips in use and compare to previously used ips for the accounts would notice something.

Cleaning house before due diligence.