IDOR Fix

IDOR occurs when an ID in a URL/body maps directly to a DB record with no ownership check. An attacker increments ?invoice_id=1042 to 1043 and gets someone else's data.

Two Independent Fixes (Both Required)

1. Opaque IDs     → make guessing futile
2. Ownership check → deny access even if ID is known

Neither alone is sufficient. Sequential IDs with ownership checks work. UUIDs without ownership checks don't.

Fix 1: Use Non-Guessable IDs