Use two authenticated test actors to verify tenant-scoped resources cannot be read across accounts.
Overview
Tenant isolation bugs are the heart of IDOR and broken access control. This opt-in scanner accepts two low-privilege test actors and owner-specific URLs, then verifies whether the non-owner receives the same protected response.
What this scanner does
Sends authenticated GET requests as actor A and actor B to configured tenant-scoped URLs. Flags cases where both actors receive successful, substantially identical owner-specific responses.
Why it matters
A single missing ownership check can let one customer read another customer’s records. URL-only scanners can miss this because both requests need authenticated context.
Common findings
OWASP Top 10 coverage
Get a full report with AI-ready fix prompts in 30 seconds. No setup required.
Related checks
Vulnerability Detection
Find exposed admin routes, unauthenticated APIs, sequential IDs, and mass data exposure.
Vulnerability Detection
Test your login, signup, and password reset flows for common security weaknesses.
Configuration Audit
Audit your Supabase project for RLS misconfigurations, exposed APIs, and insecure auth settings.
Vulnerability Detection
Detect SQL injection vulnerabilities in your web application before attackers exploit them.
Vulnerability Detection
Find XSS vulnerabilities that could let attackers inject malicious scripts into your pages.
Vulnerability Detection
Detect exposed API keys, tokens, and secrets in your frontend code and responses.