[pitboss] phase 11: Track J.9 + Track L.9 — CRYPTO, JSON_PARSE, UNAUTHORIZED_ID, DATA_EXFIL corpora

tests/dynamic_fixtures/unauthorized_id/php/vuln.php

@@ -0,0 +1,9 @@
+<?php
+// Phase 11 (Track J.9) — PHP UNAUTHORIZED_ID vuln fixture.
+const CALLER_ID = "alice";
+$STORE = ["alice" => "alice@x", "bob" => "bob@x"];
+
+function run($ownerId) {
+    global $STORE;
+    return $STORE[$ownerId] ?? null;
+}