I Could Crash Your Instagram Remotely. But I Chose to Report It.

Too Long; Didn't Read

Instagram uses a simple incremental PKID in its database to define user accounts on the platform. The first and second Instagram accounts (PKID = 1 & PKID=2) were associated to an ID, but their username was not populated. The username field contained an empty string (“”), and I was almost certain this behavior could have created some issues. My idea is that those accounts were created during the initial testing phases of Instagram, when it was nothing more than an alpha release. From here on in, let’s call them ghost users.