Live Idor
Live IDOR probe — tests whether other users' object IDs are reachable without authorization.
Not yet included in any purchasable tier. Pending attorney review before this tier ships live.
Example finding from the liveIdor module
/api/orders/1001 readable from user B's session — IDOR confirmed
Why we catch it
Active probes against your running site. Pen Test tier only — requires explicit written authorization for the target.
The Live Idor module sits in this category alongside 4 related modules. Together they form one of the layers of a GateTest scan — checks fire in parallel, findings cluster by root cause, and on paid tiers the AI auto-fix loop reads each finding, writes the fix, validates against the scanner, and opens a PR.
How GateTest covers live idor
- ●Not yet purchasable. Pending attorney review before this tier ships live. It's registered in the engine today so it's discoverable, but no tier includes it yet.
- ●Requires explicit authorization when it ships. Live probes only ever run against a target you've proven you own — a three-layer consent check gates every run.
Live Idor is coming soon
Pending attorney review before this tier ships live. Want early access when it ships?
Frequently asked questions
What does the Live Idor module catch?
Live IDOR probe — tests whether other users' object IDs are reachable without authorization. Example finding: /api/orders/1001 readable from user B's session — IDOR confirmed
Can I buy a scan that includes Live Idor today?
Not yet — Pending attorney review before this tier ships live. It's registered in the engine and documented here so it's discoverable, but it isn't included in any purchasable tier yet.
Which tiers include the Live Idor module?
None yet — this module is Coming Soon. Pending attorney review before this tier ships live.