I noticed that a local car dealership did not require any authentication to book appointments and in turn found out that the site leaked information. The blog post https://thatsabug.co/down-the-rabbit-hole/ explains the issue in detail and the podcast is us discussing this particular issue.