Here is a real API endpoint. It authenticates the user, it returns a 404 when it should - and it still leaks every customer's data. Click the line you think is the bug.
The missing ownership check you just looked for is Broken Object Level Authorization, the number one API risk. In 2023, attackers abused a single API this exact way to take the personal data of 37 million T-Mobile customers. No system was hacked. It ran undetected for 41 days.
Source: T-Mobile Form 8-K filing, U.S. SEC, January 2023.
Every risk in the guide is laid out like the challenge: what it is, the request that exploits it, and the control that closes it.
