Daily security quiz #5

Question for 2026-11-05. Read the code and pick the most serious security vulnerability.

This API returns order details. The logged-in user is stored in req.user. What is the most serious vulnerability?

1app.get('/api/orders/:id', requireLogin, async (req, res) => {
2  const order = await db.order.findUnique({
3    where: { id: Number(req.params.id) },
4    include: { items: true, shippingAddress: true },
5  });
6  if (!order) return res.status(404).end();
7  res.json(order);
8});

1. AChanging only the order number lets you view someone else's order and shipping address (IDOR)
2. BConverting with Number() makes SQL injection possible
3. CReturning 404 is dangerous because it reveals whether an order exists
4. DLoading related data with include causes poor performance