path traversal and IDOR..

likely been active since the inception of these capabilities

wonder if the recommendation to "add randomness to resource names" is because of this (unrelated security by obscurity lol)