I'm gonna crash out.
I reverse engineered an app published by the Saudi Government a few days ago and found a private bank certificate file along with client id and secret inside it.
One could completely empty the linked bank account.
When I reported the vulnerability, I was told that the portal is only for Saudis.
ok nvm