Hello, this is my first post on Medium about bug hunting. Here, I'll explain how I discovered a race condition bug that allows bypassing the limits on a restricted free account. Read on below.

There are definitely differences in how free accounts and paid accounts (Level 1, 2, and so on) function within an app. I bypassed the limit when creating an app project, as free accounts are limited to a maximum of 100 projects.

I sent as many POST requests as possible.

None
Duplicate Request

After I created multiple POST requests for new projects, I sent those requests. AND… IT WORKED.

None
Result After send POST Request

I immediately submitted a bug report to the app developers, and it was marked as VALID. The bug has now been fixed.

Thank you for reading my first post.