On a Tuesday in May we walked a KUL–PEN path that used one passenger form for every sector the operator sold. KUL–SIN sat in the same template. The passport-number field was required. The date-of-birth field sat under it, then a nationality list that defaulted to Malaysia.
A person booking a Penang weekend with a MyKad does not have a passport number in muscle memory. Some type the MyKad number into the passport box. The form rejects the length. Some leave the room to find a drawer. The session is gone when they return.
The fare grid was not the leak. The leak was a required field that belongs to an international sector, left on because splitting the form looked expensive. Two other apps on the same city pair hid the passport box until the destination country was not Malaysia.
If your domestic and international paths share a form, sit with a MyKad in your hand and refuse to open a passport. Time how long you last. That is the briefing, before anyone talks about colours.