Prepare known test data.
Create dedicated User A and User B accounts in the application you own. Make a row owned by A, using synthetic data. Keep its ID and ownership clear.
The tester must distinguish A’s private object from public, shared or mixed-owner data. Ambiguous ownership is reported as untested rather than treated as a vulnerability.
Replay the same request.
Capture a scoped read that A makes. Replay the request using B’s session, then without a session. Compare responses only within the designated test data scope.
If B receives A’s private test object, the server is missing an ownership check. Hiding a button or redirecting a page does not protect the API that returns the object.
Keep writes separate.
Read replays can run on verified production targets when they touch test-owned data. Update and delete tests require staging, designated disposable rows and explicit opt-in.
Generic write routes and unsafe rollback assumptions are outside the tester’s scope. Skipped writes remain untested. After any allowed write, recreate the disposable fixture if needed.
Put it to the test.
Run an audit on an app you are authorized to test.