"Accessing internal apps in ways you shouldn’t?"

At a high level, how do they do that? I can only think of a bunch of rules, and that will have to be tweaked endlessly to deal with edge cases.