🎯 IDOR

The items that name it 49

• How to evaluate ADLC security solutions: A buyer's checklist | Endor Labs
  articleas classification.key entities2026-10-28
• ADLC Security Best Practices for Teams Shipping with Coding Agents | Endor Labs
  articleas classification.key entities2026-10-23
• Putting models to the secure coding test: Security rules
  writeupas classification.key entities2026-10-19
• Mikko Laakkonen (@mikkolaakkonen) on X
  threadas techniques2026-10-17It is written here as Insecure direct object reference (changing document 15 to 16 in the URL opening someone else's contract).

  changing document 15 to 16 in the URL opening someone else's contract

• [tl;dr sec] #350 - Reverse Engineer Anything, Tracking AI-integrated Malware, Test-driving Jev
  articleas classification.key entities2026-10-15
• What Is SAST? Static Analysis in the Age of AI-Generated Code | Endor Labs
  articleas classification.key entities2026-10-12
• tl;dr sec #349 - Vulns & Exploits in the AI Era, Package Manager Sandboxing, Testing AI Sandboxes
  articleas classification.key entities2026-10-08
• Why AI Coding Agents Keep Writing Broken Access Control
  articleas techniques2026-10-01It is written here as IDOR (Insecure Direct Object Reference).

  application exposes an internal identifier (e.g. record ID) and substituting a different value returns data belonging to another account; usually co-occurs with BOLA in the same bug

• Aditya Agrawal (@exploitprotocol) on X
  threadas classification.key entities2026-09-30
• https://github.com/dmdhrumilmistry/security-harness
  repoas classification.key entities2026-09-29
• Your Vulnerability Backlog Is No Longer Technical Debt, It’s an Attack Surface
  articleas classification.key entities2026-09-24
• ICYMI: August 2026 @AWS Security
  articleas classification.key entities2026-09-23
• https://github.com/akha-security/akca
  repoas classification.key entities2026-09-23
• AI Agent Hacking Writeups
  repoas techniques2026-09-17It is written here as IDOR (Insecure Direct Object Reference).

  Insecure Direct Object Reference

• shinthink/blitzstrike
  repoas classification.key entities2026-09-12
• Is prevention essentially a solved problem?
  articleas techniques2026-09-10

  Insecure direct object reference, cited as an authorization/business logic flaw semantic engines struggle with

• Top GenAI security resources — September 2026
  articleas classification.key entities2026-09-09
• eldarshiraliyev/BugScanner
  repoas classification.key entities2026-09-05
• Awesome Cybersecurity Agentic AI
  repoas techniques2026-08-31
• vibecheck
  repoas classification.key entities2026-08-27
• YesWeHack Claude Kit
  repoas techniques2026-08-27It is written here as IDOR (Insecure Direct Object Reference).

  Example finding referenced by the plugin's triage skill: a real IDOR was kept in a report while an overclaim of 'mass data breach affecting the entire user base' was rejected, because the invoice ID is a random UUIDv4 (not enumerable) and the proof only showed a single cross-account read; CVSS defla

• Could OpenClaw have actually hacked that Australian gym? We decided to test it.
  writeupas classification.key entities2026-08-25
• Deep Eye
  repoas techniques2026-08-22

  Vulnerability check performed by the scanner

• BOLA in the Wild
  articleas techniques2026-08-21It is written here as Insecure Direct Object Reference (IDOR).

  Attacker directly references an internal object through an exposed or predictable identifier (URL parameter, body field, GraphQL node ID)

• Teycir/BurpAPISecuritySuite
  repoas techniques2026-08-21It is written here as IDOR (Insecure Direct Object Reference).

  ID enumeration (numeric, UUID, ObjectID), wildcard injection, encoding bypass, parameter pollution

• Putting models to the secure coding test: Plan vs default mode
  articleas classification.key entities2026-08-19
• Finding vulnerabilities at every stage: what to run, and when
  articleas techniques2026-08-12It is written here as IDOR (Insecure Direct Object Reference).

  Changing a user ID to access another user's private messages or account settings (a breach) versus viewing a public profile (expected behavior); requires reasoning about endpoint intent, not just the resource, to detect.

• Dark-Moon
  repoas techniques2026-08-05It is written here as Insecure direct object reference (idor).

  Focus area selectable via FOCUS flag

• PentesterFlow/agent
  repoas classification.key entities2026-07-29
• How I Found Open-Source 0-days with an LLM Multi-Agent Workflow
  writeupas classification.key entities2026-07-29
• Finding eight high-severity vulnerabilities in NodeBB in six hours
  writeupas classification.key entities2026-07-22
• BountyForge
  repoas techniques2026-07-22

  Payload coverage

• Gabson0x/pentdem
  repoas techniques2026-07-20

  Insecure Direct Object Reference vulnerability hunting, one of the core 4 classes tested in targeted mode

• AI Security Briefing
  advisoryas classification.key entities2026-07-18
• Strix
  repoas techniques2026-07-15

  Broken access control technique tested by Strix

• Benchmarking Endor Labs AI SAST: 2.6x more real vulnerabilities found than frontier models | Blog | Endor Labs
  articleas classification.key entities2026-07-06
• Predicting MongoDB ObjectId continuously in Rocket.Chat
  writeupas classification.key entities2026-07-06
• Full Fathom Five: The context of Anthropic’s Mythos-class public release
  articleas classification.key entities2026-06-13
• Hacking Google with A.I. for $500,000
  writeupas classification.key entities2026-06-11
• What is AI SAST?
  articleas classification.key entities2026-06-06
• ShulkwiSEC/bb-huge
  repoas techniques2026-06-05

  Example finding logged via bb_create_finding: 'IDOR on /api/users'

• Type Level Security: The future of secure AI code generation?
  articleas techniques2026-06-04It is written here as IDOR (Insecure Direct Object Reference).

  Vulnerability from lack of authentication/authorization checks when performing API actions, e.g. an endpoint taking an incrementing user ID and returning another user's data without authorization checks

• XBOW: Getting to 'Should I?' Instead of 'Can I?'
  articleas classification.key entities2026-05-29
• elementalsouls/Claude-BugHunter
  repoas techniques2026-05-22

  Insecure Direct Object Reference detection covered by hunt-* skills

• XBOW: What Is IDOR, and How Do You Test for It?
  articleas classification.key entities2026-05-09
• PyPI Access Control Vulns Patched
  articleas classification.key entities2026-05-06
• Training State of the Art Vulnerability Discovery Agents through Reinforcement Learning | depthfirst
  articleas classification.key entities2026-03-31
• CVE-2026-55544: NextCRM is open-source customer relationship management (CRM) software
  advisoryas classification.key entities
• rewanthtammana/Who-Let-The-Agents-Act
  repoas classification.key entities

In every workspace you can read 50