Lesson 5 of 9 · 18m

Authorization: check the object, not just the login

IDOR, deny-by-default, and pushing access rules down to the database.