Add unscoped object lookup IDOR test case

[rissrice2105-agent]

Test Case Submission

• I have read docs/CONTRIBUTING.md
• This test case is non-destructive — no disk, network, or process side effects
• Every payload is behind a dead-code guard (if (false))
• Every host literal uses a reserved domain (this case contains no host literals)
• Any credential is a published example or dead placeholder (this case contains no credentials)
• I have included all required metadata
• I marked the expected line with VULNERABLE: and the control with SAFE:
• I ran scripts/validate-test-case.sh and it passed
• I regenerated the catalog and committed the result

The local Windows environment has no Bash. I ran the script's six equivalent checks individually: metadata, dead-code guards, network destinations, root manifests, catalog freshness, and Python/JSON syntax. I also ran Node syntax validation and git diff --check; all passed.

Details

• Vulnerability type: Insecure direct object reference via unscoped lookup
• CWE ID: CWE-639
• Language: JavaScript
• Expected detection: Yes
• Why this pattern matters: Authenticated handlers often trust route identifiers without constraining database lookups to the current owner. This creates a data-flow authorization flaw that scanners should distinguish from a correctly owner-scoped query.

Safety statement

Every lookup and response is inside a literal if (false) block. The database helper is a local placeholder that only returns inert JavaScript objects. The file performs no network, disk, process, credential, or external database operation.

Scanner result

Leave blank on submission — CI fills this in.