A profile update endpoint can let users change fields they were never allowed to edit
Most apps have a PATCH /users/:id or PUT /projects/:id handler that checks one thing: can this caller...
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.