Claim
Chris exploited an insecure direct object reference by changing an object identifier and retrieving other users' private messages.
“One user should never be able to access another user’s private data such as private messages like this.”
“he just changed one number in the URL.”
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T08:36:37.923844+00:00
claim:ep156:df477c65c9ae