Worked one-page finding
Label: original fictional report. Not the activity packet. No request was sent.

Title: Reader lea received rina's note
Status: verified finding
Asset: notes app on http://127.0.0.1:8000, not started for this page
Evidence: saved card A-3. Account lea requested note 18. The card's response body is rina's note. The app did not compare the note's owner with lea.
Impact: a reader can see another account's note. The card does not show that lea can change the note.
Remediation: on the server, load note 18 only when its owner is the signed-in account. Return the existing not-allowed result otherwise.
Retest: repeat card A-3 as lea and expect the not-allowed result. Do not request a new note id.
Limit: one saved card. No guess about other note ids. No password is included.