From Dev.to
Broken Access Control Tops the OWASP List. Your Scanner Still Can't See It.
Disclosure: the author works at HACKBOX PTE. LTD., which builds HackBox — referenced once below, in the section on autonomous decision-making. Everything else here is a technical argument you can test...