Critical

Other users' data by changing an ID

Change /invoices/123 to /invoices/124 and see someone else's invoice.

What it is

An API checks that you're logged in, but not that the record you asked for belongs to you. Known as IDOR (insecure direct object reference), it's one of the most common holes in SaaS apps.

Why fast-built apps get it

Generated CRUD endpoints fetch by ID because that's what the prompt asked for. Ownership checks are an extra line nobody asked for.

Before and after the cure

app/api/invoices/[id]/route.tsVulnerable

export async function GET(req, { params }) {
  await requireUser(req);
  const { id } = await params;
  return Response.json(await db.invoice.findUnique({ where: { id } }));
}

app/api/invoices/[id]/route.tsCured

export async function GET(req, { params }) {
  const user = await requireUser(req);
  const { id } = await params;
  const invoice = await db.invoice.findFirst({
    where: { id, teamId: user.teamId },   // must belong to their team
  });
  if (!invoice) return new Response("Not found", { status: 404 });
  return Response.json(invoice);
}