Meanwhile in India we have airlines asking for OTP + Aadhaar + blood sample to change a seat, and somehow Avelo just needed 6 random chars. Beautiful write-up, Alex — this is the kind of responsible disclosure we need more of.