Hacktivity from 0xamir
https://hackerone.com/reports/152669
Users enumeration is possible through cycling through recurring[client_id] argument value.
https://hackerone.com/reports/152669