Web Development
Bug Report
IDOR in a Django invoice download endpoint let users fetch other customers' PDFs
A customer changed the number in an invoice download URL and got someone else's PDF. The endpoint looked up invoices by sequential ID with no ownership check. We scoped every query to the account, added an object policy and cross-tenant tests.