IDOR happens when an app exposes an object id (order, document, vehicle) and fails to check ownership. Attackers change the id and land in another tenant’s data.
What “proved” means
We only report IDOR when oracles agree
Control request
A garbage or out-of-scope id behaves differently from a real object.
Foreign session
User B can reach User A’s object, or the other way around.
Body diff
The response shows real data, not a blank shell page.
Evidence pack
Bound PoC steps your team can rerun.
Example
A simple mission
Prove IDOR on /api/vehicles/:id and stop when confirmed
Autopilot builds the objective, sends IDOR specialists first, and can stop early once the oracle says proved.
Also see BOLA testing, pricing, and a sample report.
FAQ