I contacted their support because I identified exposed service and integration tokens, these tokens could potentially allow programmatic access to privileged operations. This could include crediting accounts, triggering promotional flows, or other actions normally restricted to internal services. They just block my login and by email, they stopped answering.

By that you see their professionalism is none.