1. Five different times, I entered a search and clicked “yoink!” only to be taken to the search results for someone else’s search. By clicking “your searches” at the top, I was “returned” to the searches for the account of the person whose search I just intercepted.

2. When I was returned someone else’s search, it would appear in my account’s searches under the name I gave it, but when I clicked on it, it’d be the other person’s search. The only way to get it out of my list was to delete the search from their account… which it let me do.

3. Because of these two issues, my guess is that there are conflicts with the IDs you assign… these users were entering searches at the same time I was, and in many cases it’s possible for the IDs to get mixed up, and the wrong ID can be assigned to the wrong account (or multiple accounts).

4. Since the user IDs default to sequential numbers, it was easy to just type in other numbers and access the accounts of other users. From here I could see all their searches, add new searches, and delete existing searches.

5. Similar to the previous one: Since the search IDs are sequential as well, just hex instead of decimal, it was easy to type a previous ID and access someone else’s search.

Keep up the great work, guys!