IDOR vulnerability: local fixture evidence
Fixture / runner version: 1.0.0

All identities, bearer values and invoices are synthetic public demo data.
No production credentials, customer records or external API targets were used.
The server always binds 127.0.0.1. Implemented methods: GET, PUT, DELETE.

Requirements: Python 3.9+ (standard library), curl in PATH.
Tested versions and source SHA-256 hashes are in recorded-run/results.json.

Reproduce from this directory:
  python3 verify.py --output rerun

The runner refuses an existing output directory. It starts four fixture
configurations in sequence on OS-assigned loopback ports, runs 16 curl requests
against each (64 in total), records commands and full synthetic HTTP responses,
and stops each server. The configurations are:
  sequential-none   numeric IDs, no ownership check   (vulnerable)
  uuid-none         UUID IDs, no ownership check      (vulnerable)
  sequential-owner  numeric IDs, ownership check      (fixed)
  uuid-owner        UUID IDs, ownership check         (fixed)

Exit 0 means the 64 demonstration checks matched their expected responses,
including the intentionally vulnerable ones. It does NOT mean the vulnerable
configurations are secure. secure_expected_status and
authorization_boundary_holds in results.json separately identify each
reproduced policy violation.

The original command was:
  python3 verify.py --output recorded-run

recorded-run/commands.sh contains the exact executed curl commands. Its ports
were ephemeral and are no longer listening. Use verify.py for a fresh run.

Manual inspection, one terminal per server:
  python3 fixture.py --ids sequential --authz none  --port 8765
  python3 fixture.py --ids uuid       --authz owner --port 8766
Stop manual servers with Ctrl-C. --authz owner enables the ownership check
already present in the source. It is a controlled configuration change, not a
generated patch or a production remediation.

No AI agent or model ran any step of this fixture workflow.

SHA256SUMS covers the published source, text and recorded evidence files. It
provides integrity comparison, not independent attestation or authorship proof.