Status, as of publish Everything below describes what was true in the days around 30–31 August 2026. Since then: the leaked files were removed and are now blocked at the edge by firewall rules, the admin query-string value has been rotated, and — the fix that actually mattered — the schema hole that let a client mark a business "active" without paying has been closed server-side and verified against production. The admin parameter is not a working bypass any more, on either count. This is a post...