ModulesLive attack probes· Not available
Live Idor
Live IDOR probe — tests whether other users' object IDs are reachable without authorization.
Not included in any purchasable tier. Not available — reserved for a future penetration-testing product; no scan runs these probes.
/api/orders/1001 readable from user B's session — IDOR confirmed
Why we catch it
Active probes against a running site. Not available — reserved for a future penetration-testing product. No GateTest scan or tier runs these probes today.
The Live Idor module sits in this category alongside 4 related modules. Together they form one of the layers of a GateTest scan — checks fire in parallel, findings cluster by root cause, and on paid tiers the AI auto-fix loop reads each finding, writes the fix, validates against the scanner, and opens a PR.
How GateTest covers live idor
- Not purchasable. Not available — reserved for a future penetration-testing product; no scan runs these probes. It's registered in the engine, but no tier includes it.
- Would require explicit authorization. If the future product ships, live probes will only run against a target you've proven you own.
Live Idor is not available
Not available — reserved for a future penetration-testing product; no scan runs these probes. Want to hear if the penetration-testing product launches?
Frequently asked questions
What does the Live Idor module catch?
Live IDOR probe — tests whether other users' object IDs are reachable without authorization. Example finding: /api/orders/1001 readable from user B's session — IDOR confirmed
Can I buy a scan that includes Live Idor today?
No. Not available — reserved for a future penetration-testing product; no scan runs these probes. It's registered in the engine and documented here, but it isn't included in any purchasable tier.
Which tiers include the Live Idor module?
None. Not available — reserved for a future penetration-testing product; no scan runs these probes.