Crown Jewel Targets

Why IDOR pays big:

Direct access to other users' data without authentication bypass — clear, demonstrable impact
Chains easily with privilege escalation, financial fraud, and account takeover
Affects virtually every application with user-owned resources

Highest-value asset types (by payout potential):

Asset Type	Why It Pays
Financial documents / billing APIs	PII + financial data exposure (Shopify, Uber, PayPal)
Private repositories / source code	IP theft, critical data loss (GitHub)
User messages / DMs	Privacy violation at scale (Reddit)
Account management endpoints	User addition, deletion, privilege escalation (PayPal, Mozilla)
Business/org administration	Cross-tenant escalation, employee PII (Uber)
Content moderation/admin actions	Operational sabotage (Reddit mod logs)

hunt-idor