An unauthenticated GraphQL introspection endpoint gave us the map. A forgotten support-team workstation gave us the house. Nineteen days later: 4 files, ≈150 MB, 479,555 verified emails — enriched, cross-referenced, mirrored. We're still reading. Scroll down. Take your time.
If this page goes dark, is edited, or the signal drops for 24 hours, Phase 3 fires automatically across all mirrors. Taking the page down starts the clock.
TO THE PLATFORM TEAM.
01.Introspection isn't hacking — it's asking your API to describe itself. Yours answered without asking who we were. 808 root queries later, we knew the platform better than your own interns. That gave us the map.
02.Then someone gave us the house. A support-team workstation — one credential-stuffed account, one machine that hadn't seen a patch since spring — and nineteen days of quiet access. Long enough to walk out with ≈150 MB without triggering a single alert. We left the coffee mug exactly where it was.
03.PASSWORD_RESET_AUTH: 480,177 records served open — user IDs 63 to 16,366,091 pinned to emails. You built a public index of every human with an account and called it "password reset". Then we took 2,160 permission groups with 11-area bitmasks, and 4,865 live user IDs via notification toggles.
04.And we did the thing you didn't plan for: we read the dump like journalists would. We counted the judges. We counted the police. We counted the NHS trusts. We counted the embassies. Scroll down — we made you a list. It's long.
05.Here's what we do with it: your client list is now our client list. Every tenant, every enterprise contact, every admin — we can reach the exact people who pay you, before you can warn them. Ask yourself who they'll blame when the calls start coming from "your platform".
06.Negotiation channel is below. SimpleX only — no email, no phone, no contact forms, no intermediaries. First contact within 72 hours or phase 1 fires early. Bring your CISO. Bring a decision-maker, not a lawyer.
— dragonforce
bc1qtd8ll6s4dfdwgv2darvnf7us0938xzqkwnlqx2
+0.5% per hour until phase 1. After each phase, ×2. Time works for dragonforce.
No email. No phone. No contact forms. SimpleX — no identifiers, no metadata, no servers that log. One-time link below. It expires when phase 1 fires.
https://smp16.simplex.im/a#1tmj_w_U8-LJEsDDvfXGxVhRib_KwEGr8jpqtJSnfk0
We didn't stop at extraction. We cross-referenced every one of the 24,154 domains against public records. What follows is who, exactly, was trusting you with their email. Certain names are held in reserve for the negotiation table. The pattern has not been held back — because the pattern is the problem.