How do you arrive at that conclusion after reading an article on how an API had a broken access control vulnerability?