🔓 IDOR / BOLA: How to Find the #1 API Vulnerability — and Actually Prove It

Broken Object Level Authorization is #1 on the OWASP API Security Top 10 — and the bug that passes scanners and code review alike. Here's how to find it, and the part most write-ups skip: how to prove it without touching a single real user's data.