A BOLA vulnerability (also called IDOR) is the single bug we report most often on API tests. Here is how we hunt it by swapping object IDs across two accounts, and how to shut it down with server-side authorization.