I discovered an Insecure Direct Object Reference (IDOR) vulnerability in a practice web application that allowed unauthorized users to access other people's private snippets simply by changing a number in the URL. Using whatweb and manual inspection, I identified parameter tampering points and successfully accessed private data for five different users without authentication. The finding was documented in a comprehensive report including executive summary, technical details with screenshots, CVSS risk scoring, and step-by-step remediation instructions. This assessment demonstrates my ability to find broken access controls that automated tools miss and deliver clear, actionable fixes.