I remember that few years ago Stocard triggered warning in my company as he got accesses to loyalty point through an API without agreement and through an API most of us didn’t know. With the loyalty card code you could get the point balance of this. We never knew how they found their way
With my friend we have a bot who does this for us. Check out on maubot - at least it is mot client side work