What a Single File Name Taught Me About IDOR (PortSwigger Lab)

My transcript downloaded as 2.txt. That was the entire vulnerability, sitting right there in a file name, and it took less time to exploit than it did to notice. This is a PortSwigger Web Security Aca