tl;dr: A researcher found that Google's developer docs sites (developers.google.com, firebase.google.com, etc.) stored a pickle-serialized OAuth2 flow object inside a Flask session cookie, exposing the OAuth client_secret in plaintext — and that same secret was reused as Flask's SECRET_KEY for signing the cookie. This allowed forging a session containing an arbitrary pickle payload, which the callback would pass to `pickle.loads`, yielding unauthenticated RCE (demonstrated via `time.sleep`). Google paid $90,000 ($75k S0 RCE base + 20% report-quality bonus).