I will test your web app for broken access control and data leaks between users

Can one customer see another customer's data? Can a regular user reach an admin action by changing an ID in a request? Automated scanners rarely catch this. It's the most common serious flaw in web apps, and it's what I test for.

I've written access-control tests on a HIPAA-compliant telehealth platform, confirming that each user role can reach only the patient data it's allowed to see. I'm a full-stack developer on Django, Next.js and PostgreSQL, so I read your app as its builder would.

What I check, by hand, with test accounts you provide:

• Whether each role can read or change only its own records
• Whether IDs in URLs and API calls can be swapped to reach other users' data
• Whether admin actions are blocked for normal users on the server, not just hidden in the UI
• Whether tenants in a multi-tenant app stay separate

You get a report listing each issue with its severity, the exact steps to reproduce it, and how to fix it.

Tell me about your app and its user roles, and I'll confirm the scope.