Broken Object Level Authorization

AI writes the login check and skips the ownership check. IDOR is now the default review item.

A dev.to post walks through a Rails action that authenticates the caller and then loads any invoice by id. The defect is an absence, and the model's own tests confirm it.