Kind of like here when someone points out, they’ve already openly released much of the code as to how to interact with their device… but they everyone else to sign a NDA saying they won’t let anyone else know. (ok, I’ve kind of paraphrased and added sarcasm)
He didn’t actually tell much. It’s known tablo has no security, HTTPS, sign/log in, verification, authentication or parental controls.
Much of the info I’ve gathered came from old web pages and watching network traffic in a browser.