Exposed trip_no in WebSocket Responses Leading to Excessive information Disclosure

Summary

@mrrhacker discovered a vulnerability in Bykea’s WebSocket implementation where trip_no was exposed to drivers before a bid was accepted. This identifier could be used to access customer tracking URLs, revealing excessive information of the customers to unauthorised drivers. The issue was resolved by masking sensitive identifiers in WebSocket responses and introducing hashing in tracking URLs to prevent unauthorised access.