My first HackerOne report landed as a HIGH-severity information disclosure on Khan Academy. The methodology, the exact attack vector, and 7 other findings I bundled in.