BOLA Deep Dive: The Access Key

The vulnerability formerly known as IDOR is now API#1 for a reason. Learn the subtle ways BOLA hides in nested URLs, GraphQL queries, and "Export to PDF" features, and how to write a generic "AuthMatrix" test to catch it everywhere.