Enno Gelhaus

Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys

Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions