Jesus titty fucking Christ. Bugs are inevitable but this is a joke. What fucking developer thinks "yeah they're logged in so thats enough checking. They can't possibly guess a URL we don't show them, even though it's just an incrementing number"