Hunting the #1 API Vulnerability (BOLA) in Your Own REST API

A deliberately vulnerable Flask REST API is used to demonstrate common flaws: BOLA, missing authentication, overexposed user data, and mass assignment.

The piece shows how an API can still leak other users’ records even when scanners look fine, because object-level checks and safe access controls are missing.

Each issue is reproduced locally, fixed, and then locked in with pytest regression tests so the bugs do not return.

It reinforces an OWASP API Security Top 10 lesson: pair security reviews with automated tests in the CI pipeline.