Insecure direct object reference (IDOR) is a flaw where:

1. AThe website has no valid TLS certificate
2. BPasswords are stored in the database in plaintext
3. CChanging an ID in a request exposes others' data
4. DServer logs are kept for longer than needed