Intigriti challenge 0726. A duplicate key in a signed JSON manifest let an ordinary account pull a report out of a namespace it was never granted. The signature stayed valid the whole way through.