One misclick away: How I found a critical vulnerability in a dating app