Group
  • Security

    Fix IDOR: check ownership on every object access

    Finds endpoints where changing an ID in the URL or body exposes other users' data, and adds ownership checks.

    • Improve quality
    • Debug & fix
    • Intermediate
    • Cursor
    • General

Free Prompt

Audit my app for insecure direct object reference (IDOR) vulnerabilities. Look at every endpoint that takes an ID from the URL, query string, or request body and returns or modifies a record. For each one, verify that after loading the record, the code checks that the current user owns it (or has an explicit role granting access) before returning or changing anything. Where the check is missing, add it and return a 404 or 403 instead of the data. Cover the obvious cases (orders, profiles, documents) and the easy-to-miss ones (invoice downloads, export endpoints, nested resources like /projects/:id/tasks/:taskId). Do not rely on hard-to-guess IDs (UUIDs) as a substitute for authorization; obscurity is not the fix. Do not change URL structures or public ID formats. Where an admin role exists, make sure the ownership check still allows legitimate admin access without opening the record to everyone. Give me a table of every ID-taking endpoint, whether it checked ownership before, and what you added. For each fix, include a test I can run: log in as user A, request user B's record, and confirm it's refused.

What This Does / How This Helps

Finds the endpoints where swapping an ID in the URL hands you someone else's data, and adds a real ownership check to each one. IDOR is arguably the most common serious bug in vibe-coded apps. The endpoint loads whatever record the ID points to and never asks whether the requester should see it. Increment the order ID in the URL and you're reading a stranger's receipts. UUIDs make guessing harder but don't fix the missing check. The output is an endpoint-by-endpoint table with fixes applied and a two-account test for each one, so you can prove user A can no longer reach user B's records.

Want to skip doing this by hand?

Fortivibe audits your app for all of the areas these prompts cover (and more).

See What We Check

Related Prompts