The Authorization Hole Nobody Noticed

A production security vulnerability where a regular user could trigger admin-only refund functionality due to missing authorization middleware. The episode walks through auditing routes, discovering the missing middleware protection, and fixing the authorization hole that allowed unauthorized financial transactions.