APIs are the real front door. Browser XSS still matters, but broken object-level auth pays attackers better.
Test authorization, not only authentication
Confirm users cannot read or mutate another tenant’s resources even with a valid token.
- IDOR / BOLA on primary resources
- Rate limits on login and expensive endpoints
- Schema validation for unexpected fields