# web

A repeatable workflow for finding broken object-level authorization in modern APIs — from mapping object references to proving impact.

Turning a wildcard scope into a prioritized attack surface without melting your VPS — passive first, resolve, probe, then triage.