A new field user with no boards assigned saw every board
Two new field staff were given no boards and could see all 101. A week later a user with 51 boards was shown 123 due out of 128. Two causes, one fix.
Topic
Security
Permissions, isolation, credentials, and failures that stay quiet.
24 articles
About this topic
The security writing here is shaped by having cleaned up after a real compromise rather than by a framework. The lesson that keeps recurring is that the failures which matter are the quiet ones: a backup that has been failing for four days, a permission model that a CSV export walks straight past, an audit log with a bucket of events nobody has ever looked in.
Detection by pattern matching is treated with suspicion throughout, for a specific reason — signature scanning found nothing on a site that turned out to hold two hundred and eleven malicious files, and file-integrity comparison against the official distribution found them all. Attackers write code to defeat patterns. They do not rewrite the upstream release.
Any monitor could export every employee in the company
A manager who should see 33 people could reach 726 and export 15,452 rows. An empty team also meant no limit at all. How it was found and closed.
The audit log was empty, so nobody knew who changed what
A hire business relied on its audit trail. It held nothing for ID, bank and odometer changes, and no row for 1,231 vehicle documents. Two quiet faults.
The website login said cookies were blocked
A login that failed at random hid a worse fault: the site served a logged-in administrator's page to anyone. Fifty-six emails were stuck as well.
Operations staff could see what every client was charged
The crew who mount and photograph boards could open Billing and read client rates. Removing the permission revoked nothing, and the next fix would have erased data.
Stopping a hacked WordPress site being hacked again
Cleaning up and adding security plugins kept us maintaining a position. Rebuilding our own site as static pages removed what there was to attack.
Anyone signed in could write anyone else's sales target
The complaint was that the target screen was unfriendly. Underneath it, the save endpoint checked nothing and 866 of 877 targets were in the wrong units.
What stops the AI showing a junior the salaries
If staff can ask an AI about company data, what stops it answering the wrong person? Not a sentence telling it to behave. Where the refusal has to live.
A code on a screen that gives a tablet a child's session
A test harness could not photograph one screen, on purpose. It shows the credential that pairs a tablet to a child, and that changes how it is stored.
A customer portal showed one customer the others' prices
A pricing panel asked for one customer's agreed prices and got every customer's. Nothing failed or warned. How far it went, and how we closed it.
The production guard was a line one flag deletes
A login endpoint with no credential was fenced off by an assert. One optimisation flag strips every assert from the build, and the fence with it. Caught in review.
Can my staff see each other's certificates?
A compliance portal let staff see their own certificates, but a read-only role could see everyone's, and the protection rests on copied lines.
Could a customer see my margin if I send a quote link?
A no-login quote link is a second way for your costs to reach a customer. We built it on the same stripping as the PDF, then the client asked us to remove it.
A total that could include another customer's invoices
A view over tables protected by row-level security ran with its owner's rights and would have summed every tenant's receivables. Caught before any customer saw it.
Can staff get round permissions by uploading a spreadsheet?
A clerk allowed only to upload spreadsheets could create customers and products she could not create by hand. And one bad row could stop the whole upload.
The generated app client attached the wrong credential
An API client generated from a live schema guessed which credential each route needed from its path prefix, and got one pair backwards. It failed safe.
Signed out, and still able to get in for eight hours
Signing out of this compliance system changed nothing on the server. A copied login stayed good for eight hours, and access changes left no trail for an auditor.
Our audit log said nothing changed when a password did
An audit trail hid the request but stored old and new password values in clear, then showed a password change as no change. Both faults and the fixes.
The owner could sell from a store that has no till
A sales rule checked that a site had a till but skipped the check for account owners, so a sale could be booked and stock taken from a production store.
Website hacked again after cleaning, and the scan says clean
A site was cleaned several times and kept being reinfected while the scanner reported clean. Comparing every file with the official release found 211 files.
One password for every site: one breach, every site
One website on a shared server was hacked, and every site on it fell because they all used the same database password. Why reuse removes your defences.
Sites sharing one server: one breach reached every site
Several websites ran as one user on one server. When one was hacked, all were, and the security plugins were doing nothing. What separating them changed.
A branch manager could export everyone's customer list
Every screen limited a branch manager to their own branch. The report export did not, so one click produced the whole company's customers and payments.
Staff saw the record in the list, then got not found
A branch check compared two different kinds of value and denied everyone. Fixing it led to 37 actions a branch user could have taken on other branches' records.