We don't read your source code. We use your app.

{
  "views": [
    { "path": "/", "title": "Home", "status": 200 },
    { "path": "/dashboard", "title": "Dashboard", "status": 200 },
    { "path": "/settings", "title": "Settings", "status": 200 },
    { "path": "/api/users", "method": "GET", "status": 200 },
    { "path": "/api/users/:id", "method": "GET", "status": 200 },
    { "path": "/api/checkout", "method": "POST", "status": 200 }
  ],
  "forms": [
    { "action": "/api/login", "fields": ["email", "password"] },
    { "action": "/api/checkout", "fields": ["amount", "token"] }
  ],
  "transitions": [
    { "from": "/login", "to": "/dashboard", "trigger": "auth" },
    { "from": "/cart", "to": "/checkout", "trigger": "click" }
  ],
  "auth": {
    "provider": "supabase",
    "flows": ["login", "refresh", "logout"]
  }
}

{
  "findings": [
    {
      "id": "IDOR-001",
      "severity": "critical",
      "title": "User data accessible cross-session",
      "endpoint": "GET /api/users/:id",
      "cwe": "CWE-639",
      "owasp": "API1:2023",
      "evidence": {
        "request": "GET /api/users/42 (as user_b)",
        "response_status": 200,
        "body_similarity": 0.97
      },
      "remediation": "Add authorization check..."
    }
  ],
  "summary": {
    "critical": 3, "high": 8,
    "medium": 21, "low": 15
  }
}