One customer seeing another's data
Just change a number in the address and someone else's data opens up. It's one of the most common flaws in apps built fast — and one of the most damaging for data privacy.
What it is
Each customer should see only what belongs to them. This flaw happens when the system serves up information without checking whether the person asking actually has the right to it — it simply trusts the address the browser sent.
- The number in the URLMany apps identify a record by a number in the address (…/order/1042). Changing that number should return "access denied" — but sometimes it just opens.
- The check is missingThe system fetches the requested record without ever asking "does this record actually belong to this user?" before handing it over.
- It applies to everythingOrder, invoice, message, photo, profile — anything identified by a number can leak this way.
How an attacker uses it
No sophisticated tooling needed: sometimes it's just changing a number in the address bar and seeing what comes back. That's why it's so heavily exploited.
- Trial and errorThe attacker changes the number over and over and collects whatever data appears, one record at a time.
- Mass harvestingWith a simple script, they walk through every number in sequence and download the whole database in minutes.
- Sensitive data in handName, phone, ID, address, and purchase history for all your customers — ready to leak or sell.
Where it usually shows up
It shows up in almost any app that has a "customer area" and was built without a review of who-can-see-what.
- Detail screensPages like "view order," "view invoice," "view profile" that load by number without checking the owner.
- The APIs behind the appThe addresses the app calls behind the scenes tend to have the same flaw, and are even easier to attack.
- AI-built appsThe AI wires up the lookup-by-number quickly, but rarely adds the permission check on its own.
How we find and fix it
We do exactly what an attacker would — change the numbers and try to reach what we shouldn't — map where the check is missing, and help you close each point.
- We test like an attackerWe log in with one account and try to view another account's data — on every screen and every internal endpoint.
- We map the gapsWe list exactly where the system serves data without confirming the owner, from the most serious to the least.
- We shut the doorWe help put a permission check on every access, so each person only ever sees what's theirs.
Is one of these your pain?
Tell us your case — in the scoping call we confirm whether it can be automated and show you the upside before you decide. No obligation.
Start a project