IDOR: The Vulnerability Class Your Scanners Will Never Find

In 2023, a researcher changed a single number in a URL, /api/orders/10021 to /api/orders/10022, and got back a complete order record belonging to someone else. Name, address, items purchased, last fou