This would be a Stripe vulnerability which I would have trusted them to report

→ View original post on X — @benthompson