tl;dr

• Create a note with meta redirect tag to get callback.
• Leak the flag using search functionality.