How a simple mistake left Arc Browser wide open to hackers