#authorization

Broken access control and IDOR

Why returning 403 for someone else's resource is itself a leak, and why Linkstash returns 404 instead, with the real routes and requests to prove it.