Beeper's user search passes your query directly into a SQL UNION. Pivot from the users table to the secrets table and extract the hidden flag.
