Endpoints that trust the ID in the URL

GET /api/orders/41 returns order 41. The endpoint checks that you are logged in, but not that order 41 is yours. Change 41 to 42 and you are reading someone else’s order.

Nothing breaks visibly when this check is missing, which is exactly why it is missing so often. The app works perfectly for every honest user.

After loading the record by ID, verify it belongs to the requesting user before returning it. Return 404 rather than 403 when it does not, so the endpoint does not confirm that the record exists.

Apply it to every endpoint that takes an ID, including update and delete — a read-only leak is bad; a delete-anyone’s-record endpoint is worse.

Switch sequential integer IDs to UUIDs. This is defence in depth, not the fix — an endpoint without an ownership check is still broken with UUIDs, just harder to walk. Do the ownership check first.