Booking tracking information
The SWAT API offers a shareable tracking link for booking progress visibility. However, this unauthenticated API endpoint is vulnerable to unauthorized access if the simulationid and booking_id are known. The link displays booking information from both sender and recipient viewpoints, with differences in the displayed number of stops and status history, including scheduled times.