Reminds me back at a certain large travel website I worked at, someone left the debug promo codes enabled in prod... Eventually someone found the "5000off" code, and posted it to Slickdeals. We had alarms for bookings that lost us money (especially with bundled flights), so it was found relatively quickly, but around 30 people had used it already... Except SBF was just massive fraud, not a whoopsie doopsie.
How did they find the code? Brute force?
They had a MBP with a butterfly keyboard