Eaton Zubair, a security analyst at security firm Traceable AI, discovered a flaw in the API of the delivery system of McDonald's India, specifically McDonald's India, owned by Hardcastle Restaurants.