CheckVibeCodeCheckVibeCode
Checks/Vulnerability
VulnerabilityHeuristic4 checks

IDOR & Broken Access Control Scanner

Find exposed admin routes, unauthenticated APIs, sequential IDs, and mass data exposure.

Run this scanSee pricing

How this scan works

  • Crawl same-origin links for numeric/sequential ID patterns in paths and query params
  • Re-request with the ID incremented/decremented — unauthenticated, GET-only, never mutates
  • Flag consistent 200s returning distinct records as enumerable IDs
  • Probe common admin/API paths for unauthenticated 200s

More checks in Vulnerability

SQL Injection ScannerCross-Site Scripting (XSS) ScannerAPI Key Exposure ScannerCORS Misconfiguration ScannerCSRF Protection ScannerAuthentication Flow Scanner