# The Red Agent POV: The One Boolean That Broke a B2B Platform’s Credit System

Free-tier users could append an unmaskContactData boolean to the people-search API, bypassing credit gating to retrieve unmasked emails and phone numbers at scale.

- Payout: Research
- Severity: high
- Program: B2B data platform
- Credited: Wiz Research
- Disclosed: 2026-07-15
- Write-up quality: 6/10
- Original: https://www.wiz.io/blog/red-agent-pov-business-logic
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-red-agent-pov-business-logic
- Tags: domain:api impact:data-leak impact:pii-leak kind:research platform:threat-intel sev:high tech:rest technique:js-analysis technique:source-review vuln:access-control vuln:business-logic vuln:fee-bypass

**Target:** REST data API endpoint /api/internal/data/hPeopleSearch
**Root cause:** Backend honored a client-controlled boolean flag (unmaskContactData) to return unmasked contact data without verifying the user's credit balance or tier entitlements; the UI simply never sent it.
**Steps:**
1. Analyze frontend JS bundles (~130MB) to enumerate API endpoints including `POST /api/internal/data/hPeopleSearch`.
2. Find `unmaskContactData` boolean referenced in request schemas but never sent by the UI.
3. Capture baseline free-tier search request; confirm email/phone returned masked.
4. Replay request with `"unmaskContactData": true` in JSON body using free-tier JWT.
5. Observe response returns cleartext email, phone, and `isMasked: false`.
**How found:** Client-side bundle analysis surfaced internal endpoints and a schema-referenced flag the UI never sent; hypothesis that backend trusts client input for entitlement decisions, validated by baseline-then-inject comparison.
**Exploitation:** Any free-tier account could POST to the internal search endpoint with the reveal flag set true, returning unmasked business emails, direct phone numbers, and personal emails for records at scale (rpp up to 200 per page) without spending credits.
**Escalation:** Pagination via `page`/`rpp` allowed bulk harvesting of the full 600M+ contact dataset.
**Insight:** When reverse-engineering frontend bundles, hunt for request-schema fields the UI never sends (reveal/unmask/admin/debug flags) — they often indicate server-side features gated only by UI omission, not authorization.