1. I wouldn't use the word "exploiting" in relation to missing access controls.

2. Why link to a toot instead of the blog post itself?