Found a reflected XSS living inside a JSON endpoint, the kind of thing I usually write off as a dead end. This one turned out to be real. Here's how I confirmed it, why the nosniff header did nothing, and the text/plain form trick I used to actually land it.

A four digit OTP, a ten minute lockout, and a backend that never got the memo. The story of the laziest brute force I ever ran turning into an auth bypass.

A messy little bug where a URL inside a URL made the server phone a stranger, then reflect whatever it said straight into the page.