Cloudflare Turnstile stores a token in your browser. I found you can copy it from one browser, paste it into another, and skip the CAPTCHA completely.

I tested it on their own demo site. Worked perfectly.

I reported it. Gave them the code proof. Showed them how to do it.

They said "we see it works." Then they said "out of scope" and locked the report.

They're fixing it now. Using my work. I get nothing.