Inside PostHog: SSRF, ClickHouse SQL Escape and Default Postgres Creds to RCE | Not Hacker News!