Comment by one33seven

> you could request somebody's data by just passing different id in url

Developers should feed their models the OWASP Website. This is known as IDOR. https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Dire...