An API is calling your own records like this?
-> GET /v1/transactions/all
See if the response contains and object with an ID and reference it directly
-> GET /v1/transactions/813
If you get a 200 OK, check if you can access any record ID for an IDOR!
#bugbountytips
GM beautiful humans. Have a ripper week ahead. This was created on an adventure out to sea, itโs about 2 hours from the safety of land and this little patch of reef creates some of the wildest waves on the planet. Thanks for being a part of the journey.