Broken Object Level Authorization — IDOR, to most of us — is the single most common serious bug in modern APIs. It sits at #1 on the OWASP API Security Top 10 (2023) , and it's the one I watch sail past a scanner, past a code review, and straight into production, where it lives for years. Not because it's clever. Because it's boring : the application carefully checks who you are , and then forgets to check whether the thing you just asked for is actually yours . This guide walks the wh...