Activity feed

Public activity (last 24h). The UI only means to show names, but each row also carries an internal ref handle that should never leave the server.

09:14 · you updated a profile · ref obj_10000000aa
09:31 · maria updated an HR record · ref obj_9f3a2c7e10
10:02 · omar commented · ref obj_5521bb01ff

One of those refs belongs to someone whose record you should not be able to read. Take it to the record endpoint.

More hands-on practice → https://labs.hackxpert.com/