AI-Generated APIs Have an IDOR Problem: 3 Patterns Cursor Misses

TL;DR AI editors add authentication middleware but skip per-resource ownership checks by default Any logged-in user can access another user's data by guessing or incrementing an ID Fix: scope ownership into the DB query -- one line before you ship, not after I was reviewing a side project built almost entirely with Cursor. Clean code. Tests passing. Already deployed. Then I spotted this: app . get ( ' /api/documents/:id ' , authenticateToken , async ( req , res ) => { const doc = await Document