The Authorization Bug No Scanner Understands

Authorization is a fact about who should access what — intent, not syntax. A pattern scanner sees the code path taken; it never sees the intent the path was supposed to enforce, which is why broken ac