Exploiting McDonald's APIs to hijack deliveries and order food for a penny