Checks · AUTH-009

AUTH-009 · IDOR: resource fetched by id without owner check

Why it matters

If an id in the URL loads a row with no owner check, changing the id loads someone else's data.

How we detect it

A request id flows into a query that does not filter by the signed-in user. Generic hits are triaged.

How we fix it

Add an owner filter to the query.

Can it be fixed automatically? With review

Related checks

• SEC-008 · Hard-coded admin email or password
• AUTH-001 · Admin route without auth check
• AUTH-002 · Authorization by client-side flag only
• AUTH-003 · Supabase user_metadata used for roles