Challenge 1 / 2

Why isn't hiding a link with is_granted() enough to secure a controller action?

Because is_granted() checks only work for logged-in users..

Because it only hides the link in the page. Someone can still type the URL (or change the ID) and hit the controller action unless the controller also blocks it.

Because Twig permission checks are ignored when a voter is involved.

Because is_granted() can only check roles, not custom permissions.

Rewatch the video