A routine bug hunt led me into gambling for a domain. It turned out I had just accidentally executed a supply chain attack on several legacy Balkan websites.

I didn’t want state secrets; I just wanted a fucking t-shirt… Here is how I got jerked around by a government agency about an ‘Accepted Risk’ that definitely wasn’t accepted, and used their own WSDL files to prove them wrong.