Realist

I found the cookie being processed by PHP in an unsafe way, and I also found a "hidden coffee" and got a token for the "hidden coffee". I don’t know how to continue.. Which file contains the validation password?