A valid session and a valid object ID can still produce an access-control flaw. The useful question is where the application binds the requested object to the current identity.
Bring a small, coherent evidence set into the conversation. Ask for the path from input to sensitive operation, the assumptions along that path and the next observation that would distinguish a flaw from expected behavior.
Start with this material
- A route, handler or request/response pair with credentials and personal data removed.
- The expected access rule: which role or tenant should own the object and which actions are allowed.
- Two synthetic test identities and a record of which identity owns each object.
Work through the evidence
- Map the input, authentication check, object lookup and response. Ask the model to cite the relevant line or request for each step.
- Compare owner, non-owner and unauthenticated behavior. Keep one variable different between requests so a result is interpretable.
- Ask for a minimal regression test and a tenant-bound query or policy change. Review the change against the real data model.
- Run the selected checks in your test environment. In-product HTTP actions depend on current mode availability, engagement scope and exact-action approval.
A prompt to adapt
Adapt to your evidence
Review the attached report endpoint and these owner/non-owner responses. Find where object access is bound to the session tenant. Separate observed behavior from assumptions. Propose the smallest fix and three regression tests: owner access, cross-tenant denial and missing authentication. Do not treat a successful status code alone as proof of disclosure.
Check the result
- A claimed disclosure includes the actual non-owner response and identifies the protected data.
- The proposed fix checks ownership on the server, including alternate routes and indirect lookups.
- Regression tests fail before the fix and pass after it; error handling does not disclose the object through another field.
Bring your own evidence into a conversation and work through the next question.
Open chat