the API that accidentally shared everyone's documents

How I managed to find the personal documents of all users due to a misconfigured API

API Misconfiguration lead to Full ATO

How I found a critical bug in API...