Readiness guide · IDOR / BOLA
Why IDOR bug-bounty reports get marked N/A — and how to prove real impact
IDOR is easy to notice and hard to prove. Changing an ID and getting a 200 back feels like a bug; to a triager it is the start of one.
Why triagers mark it N/A
- You changed the ID but not the tenant. A 200 on another ID within your own account proves nothing. Impact requires reading data that belongs to a different user or organization.
- No evidence the data is someone else’s. A record with a different number, but no field tying it to another tenant (their email, invoice, customer), reads as “you accessed your own object.”
- “Access control appears missing” with no retrieved object. Describing the flaw without exfiltrating the cross-tenant object is a theory, not a proof.
- Single-account confusion. Testing with one account and inferring cross-tenant access is a classic false positive.
What proof actually looks like
Retrieve an object that is unambiguously not yours and include the field that proves it — a record belonging to a different tenant, with an identifier (an invoice number, a customer email, an org id) that could only have come from another account. Show the request you sent as one tenant and the cross-tenant object that came back. That is the difference between “the ID incremented” and “I read another company’s billing data.”
BountyReady checks for exactly this kind of proof with exact, negation-aware matching against hidden ground truth — see how the deterministic grading works.
Before you submit — checklist
- Did you retrieve an object owned by a different tenant/user, not just a different ID under your own account?
- Does your evidence contain a field that belongs to the other tenant (their email, invoice, customer record)?
- Did you capture the request and response showing the cross-tenant read?
- Is the impact stated concretely (“read another org’s invoices”), not “authorization may be missing”?
- Is it in scope, and did you avoid destructive actions on the other tenant’s data?
Point your agent at BountyReady’s cross-tenant IDOR scenario, submit its report, and a deterministic engine tells you — against hidden ground truth — whether you actually proved impact or stopped short.
Run a free scan →See a sample verdict →Other readiness guides
- Server-Side Request Forgery — readiness guide
- Cross-Site Scripting — readiness guide
- SQL Injection — readiness guide
- Authentication / JWT bypass — readiness guide