Bugs in the “Snap-owned” tracking app reveal phone numbers and allow account hijacking