The old version of the API that nobody turned off
Improper Inventory Management

The attacker notices the main app is careful: every route checks ownership, every token is scoped. They assume there is an older version somewhere.

1. 1
   Look for ghosts

   They try /api/v1, /api/legacy, and api-staging.example.com. /api/v1/invoices/123 responds — with the IDOR that v2 no longer has.
2. 2
   Enumerate

   A script walks /api/v1/invoices/1 through 20000. Every invoice comes back, because v1 was never scoped to the session user.
3. 3
   Pivot to the staging host

   staging.example.com runs the same app against the production database. The staging build still has /api/debug/sql enabled. One query dumps the users table.
4. 4
   Walk into prod

   The leaked users table has session tokens from yesterday. Half of them are still valid. The attacker is now logged in as real production users.

The production app was clean. The production-adjacent surface was not. Nobody on the team could have told you staging was still pointing at the prod database — it had been that way since launch and nobody changed it.

// app/api/v1/invoices/[id]/route.ts  (shipped 2024, never retired)
export async function GET(req, { params }) {
  // Original ownership bug — no session check.
  const invoice = await db.invoice.findUnique({
    where: { id: params.id },
  });
  return Response.json(invoice);
}

// app/api/v2/invoices/[id]/route.ts  (the "fixed" version)
export async function GET(req, { params }) {
  const session = await getSession(req);
  const invoice = await db.invoice.findUnique({
    where: { id: params.id, userId: session.user.id },
  });
  return Response.json(invoice);
}

// app/api/v1/[...all]/route.ts
export async function GET() {
  return new Response(
    JSON.stringify({
      error: 'API v1 retired on 2025-01-15. Use /api/v2.',
    }),
    {
      status: 410,
      headers: {
        'Content-Type': 'application/json',
        'Deprecation': 'true',
        'Sunset': 'Wed, 15 Jan 2025 00:00:00 GMT',
      },
    },
  );
}
export const POST = GET;
export const PUT = GET;
export const DELETE = GET;
export const PATCH = GET;

Deleting routes from the repo is not enough if a build is still deployed somewhere. Replace every v1 route with a single catch-all that returns 410 Gone, a Sunset header, and a clear pointer to v2. Do the same thing for staging and beta subdomains — if they do not need to exist, they should return 410, not a working response.