Skip to content
AI Security

Interview question · Application & API Security

What is broken object-level authorization, and how do you find it at scale?

Scanners rarely find it, because every request looks valid. Finding it at scale is a testing design problem, not a scanning problem.

mediumEssentialNewPreparation tags: Meta, Amazon, GoogleUpdated Nov 2026

Scanners rarely find it, because every request looks valid. Finding it at scale is a testing design problem, not a scanning problem.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

signing in unlocks more free answers per topic

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

An invoices API returns /api/invoices/{id} for any authenticated user, and IDs are sequential integers.

  1. What is broken object-level authorisation?
  2. Would switching to random IDs fix it?
  3. Why do scanners miss it?
  4. How do you find it at scale?
  5. How do you prevent it in new code?
  6. How would you fix and prevent this class?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Sign in free to open it.

UP NEXT ON YOUR JOURNEY
Next in this trackExplain the same-origin policy, CORS and CSRF. Does using JWTs prevent CSRF?Next in this trackWhy can deserialising untrusted data execute code?Next in this trackPath traversal and zip-slip: why do they matter again when agents read and write files?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.