SecaWhat a finding looks like
Blurred example. Every real finding ships with steps, requests, evidence, fix and retest. Full samples + references on NDA call.
Finding S-2026-03 — IDOR to order data [High]
Impact: Any authenticated user could read another customer order by changing order_id. Names, emails, totals exposed.
Reproduction (abridged)
- Log in as User A, open /orders/10241
- Replay GET /api/orders/10242 as User A
- 200 OK with User B data — no object check
Evidence
Request/response pair + screenshot redacted in sample. Full PoC in real report.
Fix
Enforce server-side ownership check on every order read; add tests for cross-tenant IDs; backfill audit log.
Want the full 2-page sample?
Email hello@secatix.com with “Sample”. NDA if you want.