Well-known Australian information security professional Patrick Webster has been visited by NSW Police officers following his disclosure of an embarrassing Web application security bug to his superannuation fund.

Webster had noticed his pension fund, First State Superannuation allowed logged in members to access online statements via “direct object reference,” a security lapse so boneheaded it is included in OWASP’s infamous top ten list of web application security bugs.

For those unfamiliar with direct object reference, it means documents are served up by way of a direct ID in a URL. The problem is that by changing the document ID in the browser’s URL bar, another document will be accessed and served to the user.