0 / 7 access controls broken this session (state is in-memory; runs under a single worker). Each item flips to done the moment the server accepts the unauthorized action. No flags - this pack is graded on the checklist below.
⬜ NAKED - IDOR (numeric): read another user's order by id
⬜ NAKED - BFLA: admin-only function reached by forced browse
⬜ NAKED - Mass assignment: profile update sets role / is_admin
⬜ NAKED - Method tampering: DELETE succeeds where GET is checked
⬜ NAKED - Parameter-trust: server believes a client-supplied role
⬜ NAKED - Path bypass: a path variant defeats the /admin gate