Separate authentication from authorization in review

Apps usually check that you are logged in and forget to check that the object is yours. Find handlers that load a record by an id from the request and verify the query scopes to the current user.

grep -rEn "findById|get_object_or_404|findOne(|Where("id" --include=*.{java,py,js,ts,rb,go} .

The vulnerable pattern loads by id alone.

obj = Invoice.objects.get(id=request.GET["id"])   # no owner=request.user

Pro note: centralized middleware that checks authentication gives false confidence; authorization must be per object. Grep for admin or role checks and confirm they are enforced server side on the exact action, not just hidden in the UI or the route table.