That night, Mira built a tool she called The Glass Key .

Mira fed Lena’s ex his old email address from 2014. The Glass Key spat out his numeric ID. Then, the magic began.

Mira’s hands went cold. She didn’t need to see his private posts. The residue of his public digital life—the photos he was tagged in, the places he checked into, the friends who mentioned him—had painted a map of his stalking.

To this day, no one knows who runs the site. But every few hours, a log file ticks upward. Sometimes it’s a survivor. Sometimes it’s a predator. Mira doesn’t sleep well anymore.

She called Lena. “Don’t go to work tomorrow. I’ll send you the file.”

It wasn’t a login. It was a mirror. The Glass Key exploited a peculiar flaw in how Facebook cached profile images and public “about” info for SEO purposes. Even now, if you knew the exact numeric user ID—not the vanity URL, but the ancient, immutable ID—you could query a deprecated endpoint that Facebook had forgotten to fully disconnect. It returned a stripped-down JSON object: profile picture URLs from the last five years, check-ins from public posts, and the names of people who had tagged the user in comments (even if the user’s own timeline was locked).

Would you turn it?

Lena took the evidence to the police. The ex was arrested at that same diner the next evening, waiting.