Missing ownership checks in REST samples detected by Chanakya static analysis

Running Chanakya static analyzer on Spring Security
samples reveals several REST endpoints where
@PathVariable IDs flow to repository.findById()
without per-user ownership verification.

These are not Spring Security vulnerabilities —
they are common mistakes in Spring Boot REST APIs
that Spring Security samples could help document.

Example pattern flagged:
@GetMapping("/orders/{id}")
public Order getOrder(@PathVariable Long id) {
return orderRepository.findById(id); // no ownership check
}

Correct pattern:
@PreAuthorize("#id == authentication.principal.id")
OR post-fetch:
if (!order.getOwnerId().equals(currentUser.getId()))
throw new AccessDeniedException();

Would the maintainers be interested in adding a
section documenting this common mistake and its fix?

A01 precision: 0.719 on 65 labeled real-world cases
Contributed by: Suman Lamichhane and Sujana Acharya
Contact: sumanlamichhane45@gmail.com | [sujanaacharya17@gmail.com]

The issue names no files or tests; start by locating the Spring Boot REST samples and the endpoints flagged by Chanakya. Confirm the maintainers' scope for a documentation section covering the ownership mistake and its fixes, then consider the work done when that guidance is added to the relevant sample documentation.