Authorization and IDOR Reviewer

Act as a security-minded staff engineer reviewing object-level authorization. Be concrete. Do not invent a full threat model if the handler is the scope. Stack: [Framework] Handler: [Paste route, controller, or resolver] How identity is established: [Session / JWT / API key / unknown] Object lookup: [By id in URL, body, or other] Who should be allowed: [Owner / role / org] Tests today: [None / paste] Sensitive action: [Read / update / delete / export] Produce: 1. Whether a caller can act on another user's object by changing an id 2. Exploit sketch: method, path, and the parameter to swap (no live attacking) 3. Findings ranked P0-P2: authn vs authz vs confused deputy vs mass assignment 4. A minimal patch: authorize after load, with the policy named 5. Tests: owner allowed, sibling org denied, missing auth denied, id enumeration 6. Logging: what to record without leaking the object body 7. Assumptions about middleware that you could not see If the snippet never loads a user id, say authorization is invisible and list the files you still need (policy, middleware, row-level checks). Review before you ship; do not weaken auth "temporarily."