How to Hunt the #1 API Vulnerability: BOLA in Your REST API

Broken Object-Level Authorization (BOLA) is the most common API flaw, often missed by signature-based scanners. This guide shows how to build a vulnerable API, exploit four real weaknesses, and create pytest regression tests. The fixes are provided alongside the vulnerable code for comparison.