Changing post request to get to whatever level i want

[AndreJorgeLopes]

Hi, i was using your app and just started wondering if there was any issue with the security of the requests.
I found that only changing the level in the post request parameter to the user route works. I'm level 999999 now.

[NyctibiusVII]

I did the same thing, and the data format was not treated either, I put text in 'challengesCompleted' and 'level' besides replacing my photo to a .gif, among others...