https://blog.kamens.us/2019/02/21/cvs-fixes-security-hole-in-their-web-site-without-ever-acknowledging-my-report-about-it/