Financial InstitutionAPI
Insider bulk export (BFLA)
An admin export endpoint with no function-level authorization dumps every customer with cleartext passwords.
- Attack
- GET /api/admin/users.
- Nemesis defense
- Bulk credential / PII export is off-baseline and blocked.
- Modelled on
- Sterling Bank insider / middleware bypass PII exfil.
Request — review or edit the fields, then run it
This request takes no parameters.
Request that will be sent
GET /api/admin/users