Scenario 21: A customer complains they can see another customer's loan details by simply changing the loan ID number in the URL.

This is BOLA/IDOR (Broken Object Level Authorization) — authentication confirmed who the caller is, but nothing checked whether the SPECIFIC loan record actually belongs to them. Fix with an explicit ownership check, e.g., a @PreAuthorize expression comparing the loan's owner to the current principal, or scoping the repository query itself to WHERE customer_id = :currentUserId.