A hidden button is not access control
Design ownership tests for a private record.
Start or resume with saved notes →Situation
The Builder · fictional example
The situation
The Builder hides the 'edit invoice' button from other users. The server still accepts an invoice ID in a request without checking who owns it.
Before you continue
What would you predict? Say it aloud or write a line on paper. Then compare your reasoning with the example.
Starting knowledge: Understand a browser request and a user account.
Need a hint or a clearer next step?
Work through A hidden button is not access control with a focused prompt. Your notes stay private unless you choose to paste an excerpt here.
Use fictional examples. Leave out names, contact details, passwords and private records.
Get an answer here with my own OpenAI API key
Requires an active learning profile. Your provider may charge you; API billing is separate from ChatGPT. EaseBrain has no paid-key fallback.
Key clears after each attempt. EaseBrain saves only a daily request count, not your key, prompt or answer. OpenAI’s data policies apply. Up to 500 output tokens and 20 attempts a day; no automatic retries. These limits do not guarantee a spending ceiling.
Preview notes stay in this page only. Download before leaving.
Keep your work for later
Download a lesson backup, then open the saved workspace and restore it there. Preview work is not stored in this browser after you leave.