ShopFast Pay's mobile API trusts client-supplied identifiers and roles instead of checking permissions on the server. Work through three stages to see exactly how that goes wrong.
Lab cleared. All three flags verified. Check your rank on the home page.