How a Forgotten data-cfg Attribute Let Me Steal a Reviewer Bot's Cookies.

The moment it clicked