The 404 That Leaked a Live JWT and Sentry Keys

I requested a URL that didn’t exist. The server handed me an access token, a refresh token, and internal monitoring credentials. Bug…