How a Blackstone real estate company exposed Social Security digits, dates of birth, addresses, and other applicant data through a GraphQL authorization flaw

• Update: This post received some attention on Hacker News — see the discussion thread.