[awaxman11]

I'd add authorization. Right now you can access all the edit and show pages as long as you're signed in

[devinegan]

Yep, direct object vulnerable. https://www.owasp.org/index.php/Top_10_2013-A4-Insecure_Dire...

[easymode]

I just fixed it. Thanks so much for pointing it out!

I shared kickoffboost on hackernews just to see if anybody would be interested in this kind of thing. I'm getting so much traffic now and I was not prepared for it at all.