Shopclues is an Indian unicorn ecommerce marketplace. Every user who places an order on Shopclues receives a text message with a link to track the order.

The short links e.g. — http://sclu.es/3zlVa http://sclu.es/3zlVa, http://sclu.es/3zlVb, http://sclu.es/3zlVc were actually serially iterable, , .. etc are all valid links which reveals name, phone numbers, email, home address, order details of Shopclues users. A simple script to iterate over all of them can be written as follows:

We reported this to Shopclues in the first week of March 2017. We received no acknowledgment email from them. A separate email sent to their cofounders did not receive any response. We rechecked the issue on 20 March and it was not fixed but we found it fixed on 3 May 2017. The URL now asks for email id & phone number to confirm that the request is made by the authorised user.