If you use the checkbox here and refresh the page, they will reset to unchecked

Recon#

• Google dorking
• GitHub dorking
• Manual investigation of the app and proxy everything to Caido/Burp
• Wappalyzer
• Whatweb
• Subdomain enumeration
• Directory fuzzing

IDOR#

• Create two accounts (if possible two accounts with different privileges)