Find insecure direct object reference (IDOR) vulnerabilities

Detects request-supplied identifiers (path variables, request parameters, servlet parameters) that reach a data-access lookup such as JpaRepository.findById, EntityManager.find, or MongoRepository.findById without passing through an authorization check that ties the object to the current principal (CWE-639). Only projects with Spring Security on the classpath are checked; an application with no authentication at all has a broader problem than IDOR.