Web Security Academy #148 Accidental exposure of private GraphQL fields