For those interested, the demo instance is at https://sandbox.ebay.com/ The message at the top says "eBay and PayPal will be separate companies soon", even though they became seperate companies 4 years ago.
Mousing over the links there to see where they go, the first interesting-looking one was the supported/unsupported features list, over at https://ebaydts.com/eBayKBDetails?KBid=684. Ah, I see - a wall of text reminscent of "system requirements", except it's a list of things you don't get instead.
But then going up to https://ebaydts.com, I met with... a blank page. But it has a title, so something's blown up. I hit F12 half expecting to be met with some kind of implosion, and even then I was cynically amused: the page has `<body style="display:none;>`, with no closing quote, and while Chrome parses it properly the devtools don't, so the CSS editor leaks bits of HTML.
On the one hand my infosec-sense says there's probably some awesome stuff hiding in here... but on the other hand, between the 1000 feet of bureaucracy I'd have to all but drown to report _anything_ I found, and the tenterhooks I'd be on while poking around establishing there's anything there beyond plausible deniability... not worth it?
Okay, it's not just me (demo instance). Ebay's APIs and their SDK documentation (or lack thereof) are making me re-think my app's monetization model. Docs are shockingly bad, full of screenshots that look like ebay from the early 2000s.
