Wrote this after looking at a lot of agent-built apps that were one bad afternoon away from a serious problem. None of it is hard, it is just that nobody tells you to check. Change an id in a url and see if you can read someone else's data.this is the big one. Login working is not the same as permission working. Search your client side bundle for anything that looks like a key or a secret. hit your own api in a loop and see if anything stops you. Check whether your main list vie...