bola 2 API Pentesting: Evasion & Combining Techniques Dec 15, 2025 API Authorization Attacks: BOLA & BFLA Dec 7, 2025