Level 5
A hidden button is not an admin check
The scenario
PetPals has an Admin button that only shows for the owner.
But the admin action itself is not protected, so a stranger can call the same action directly.
Guided hint · Beginner mode
Picture the button as a locked handle on an unlocked door. Look at the table's Permissions → Delete rule: does it actually check User Role = Admin?