notes from the terminal https://notesfromtheterminal.dev/ Security news, research, and incident write-ups. en-ca One Vendor, $100, and a Breach That Reached Every School That Trusted Them https://notesfromtheterminal.dev/posts/2026-10-06/the-quiet-patch/ https://notesfromtheterminal.dev/posts/2026-10-06/the-quiet-patch/ Tue, 06 Oct 2026 00:00:00 GMT A broken access control (IDOR) flaw in a third-party graduation-photo vendor's platform exposed student data across Ontario and Quebec. Three months of silence, a quiet patch, and a $100 reward — the full disclosure timeline, emails included.