I Found a Bug That Exposed Private Instagram Posts to Anyone.

A security researcher discovered a server-side authorization bypass in Instagram that allowed unauthenticated access to private posts via a simple HTTP GET request with specific mobile headers. The vulnerability affected roughly 28% of tested private accounts. Meta silently patched it within 48 hours of receiving the report, then closed the case as 'Not Applicable' claiming the issue was unreproducible — despite having asked for and received vulnerable test accounts. After 102 days and multiple escalation attempts, the researcher is publicly disclosing the bug along with timestamped video evidence, a Python PoC script, and full Meta correspondence archived on GitHub.