Made a video on the stuff I run into constantly: 403s that leak whether a resource exists (just return 404), guessable sequential IDs, zero rate limiting, trusting user input.

Hope you find this video useful!