GET /invoices/:id returns an invoice. What has to be true for that to be safe, and where does the check go?
Answer it out loud before you open anything. The value of the flags below is in comparing them to what you actually said.
The situation behind the question
A finance app. Invoice ids are sequential integers. The endpoint requires a valid session and returns the invoice found by id.
What it is really testing
Whether the candidate spots that authentication is present and authorization is absent — the single most common serious backend vulnerability. Sequential ids make it trivially exploitable, but non-sequential ids do not fix it.