An authenticated user can cancel someone else's order.

That's the vulnerability I implemented in the first AgenticEnclave scenario, SEC-01, covering Broken Object Level Authorization (BOLA/IDOR).

I've been working on AgenticEnclave, a security lab focused on vulnerabilities in AI-enabled and agentic applications.

The idea is to explore these issues at the engineering level: how vulnerabilities happen, how they can be exploited, and what it takes to fix them properly.

I'm developing scenarios that cover application security, AI security, and agentic systems, with vulnerable implementations, practical demonstrations, hardened versions, and tests.