Bubba AI, Inc. 2261 Market Street, San Francisco, California, 94114 Figure 3 - Unauthenticated request to the same endpoint returning successful response with sensitive data of a user from another company. Figure 4 - Unauthenticated request to the /api/company/ endpoint returning successful response with company data.

RELAYTO Penetration Test Report - Page 8 RELAYTO Penetration Test Report Page 7 Page 9