A bug bounty hunter finds an IDOR vuln in a major tax portal, exposing millions of financial records. A story about privacy, ethics, and the HTTP protocol.