API Auth Bugs Are Usually State Bugs

Most API authorization bugs get written up as a missing check. The report says the endpoint forgot to verify ownership, as if there was one absent if statement and adding it closes the hole. That fram