Semgrep’s benchmark shows that the open‑source GLM 5.2 model, using only a unified prompt and a lightweight Pydantic AI scheduler, achieves a 39% F1 score on IDOR vulnerability detection—outperforming Claude Code’s best 37.4% while costing only about $0.17 per discovered flaw.
The author discovered a silent IDOR vulnerability in a financial system where the X-Account-Id request header was trusted by the backend, allowing any user ID to retrieve full transaction, rewards, and billing data without authentication, and reported it responsibly for a rapid fix and reward.
An IDOR access‑control flaw allowed a hacker to infiltrate France’s ANTS portal, which issues IDs, passports and driver’s licences, exposing up to 19 million citizens’ personal data—including names, addresses, birth details and authentication credentials—as the attacker claimed the breach was merely to demonstrate governmental vulnerability.
