hunting-mass-assignment-and-property-authzlisted

# Hunting mass assignment: which fields, not which object Broken object-level authorization asks whether the caller may reach *this object*. Mass assignment asks the next question: given an object the caller may write, which of its *fields* may they set? The bug is a handler that binds a request payload onto a record and trusts the client to send only the fields it should, so an attacker adds `"role":"admin"`, `"owner_id": <someone else>`, `"price": 0`, or `"verified": true` to a payload the endpoint was never meant to accept, and the framework writes it. You find it by listing what the client can put into the payload, following it to the record write, and asking which of those fields the server, not the client, is supposed to own. ## When to use - You are reviewing a create or update handler that maps request fields onto a persisted object. - The framework auto-binds or hydrates a payload onto a model, struct, or record. - Some properties of the object are meant to be server-controlled: privilege, ownership, tenancy, money, state, or verification flags. ## Scope check Test property writes only in systems you own or are authorized to test, with accounts that let you observe a privilege, ownership, or state change take effect. If you can't name the authorization, stop. ## The loop 1. **List the writable fields the client can reach.** For each create and update handler, determine how the payload becomes a record: an explicit field-by-field assignment, an allowl