NOVU_APPLICATION_IDENTIFIER and subscriberId to listen to a victim's notifications, and both of these are easily obtainable because NOVU_APPLICATION_IDENTIFIER is exposed on the client side, and subscriberId in SQL databases is often an incrementing number, making it predictable.subscriberHash when connecting. However, an attacker can modify the client code to connect without including subscriberHash since there is no configuration on Novu's host that enforces a requirement for subscriberHash to be present when users connect.