Chaining a DOM XSS Sink, WAF Bypass, Cross-Origin Smuggling, and SDK Abuse into One Click Account…

One click, eight seconds, nine webhook hits. It started with a single bracket character that broke an Akamai WAF rule.