Django Access Control & IDOR Review

Find access control vulnerabilities by investigating how the codebase answers one question:

Can User A access, modify, or delete User B's data?

When to Use

• You need to review Django or DRF code for access control gaps, IDOR risk, or object-level authorization failures.
• The task involves confirming whether one user can access, modify, or delete another user's data.
• You want an investigation-driven authorization review instead of generic pattern matching.

Philosophy: Investigation Over Pattern Matching