IDOR — missing ownership checks on resource IDs
Insecure Direct Object Reference occurs when an API accepts a resource ID in the URL but does not verify that the authenticated user actually owns that resource. Incrementing or guessing IDs gives access to other users' data.
HOW VIBECHECK DETECTS THIS
vibecheck clones your repository and runs Gitleaks, Semgrep, njsscan, and a suite of custom checks targeting patterns common in AI-generated code. This check is part of the Access Control category. When a matching pattern is found, Claude triages the finding and produces a plain-English explanation and a concrete fix — no security expertise required.
FREE SCAN
Check your repo for this and 50+ other issues
Connect GitHub → vibecheck scans for secrets, unauthenticated routes, RLS gaps, injection, and more. Claude explains every finding. Free for 2 repos.
scan my repo for free →