Yep, just left a company where the contractors building out a core solution had just such an endpoint where you could get anyone's data, and worse, personal photos.

And of course, every API key and secret was just hanging out in the repo as well.