New user with nothing assigned can see every record
A new user with no access assigned saw everything because the system read an empty list as unrestricted. How to check yours, and what the fix was.
Topic
Security
Permissions, isolation, credentials, and failures that stay quiet.
24 articles
About this topic
The security writing here is shaped by having cleaned up after a real compromise rather than by a framework. The lesson that keeps recurring is that the failures which matter are the quiet ones: a backup that has been failing for four days, a permission model that a CSV export walks straight past, an audit log with a bucket of events nobody has ever looked in.
Detection by pattern matching is treated with suspicion throughout, for a specific reason — signature scanning found nothing on a site that turned out to hold two hundred and eleven malicious files, and file-integrity comparison against the official distribution found them all. Attackers write code to defeat patterns. They do not rewrite the upstream release.
A manager could export every employee. How to limit it
A manager who should see 33 people could export 15,452 rows because the limit covered only part of the report. How to check yours and how we closed it.
Audit log empty? Why nobody could say who changed what
An audit trail held nothing for ID, bank and odometer changes, and none for 1,231 vehicle documents. Two silent faults, and how to test your own log.
WordPress login says cookies are blocked? Check the cache
A WordPress login that says cookies are blocked at random often means a cache keeping the wrong page. Ours also showed an admin's page to the public.
How to hide client rates and pricing from field staff
Field staff could read what every client was charged because removing a permission from a role revoked nothing. How to restrict pricing, and the fix.
WordPress site keeps getting hacked? What actually stops it
A WordPress site keeps getting hacked when attackers can still write to the server. What stopped it for us, and how to decide what will stop it for you.
Sales target software: who can set and change a target
Any signed-in rep could write any target, and 866 of 877 were in the wrong units. How to set and lock sales targets, and the checks an owner can make this week.
AI and company data: what stops it showing the wrong data
If staff can ask an AI about company data, what stops it answering the wrong person? Not a sentence telling it to behave. Where the refusal has to live.
Device pairing codes: how to pair a tablet to a child safely
A pairing code is a credential, not an ID: short-lived, single-use, revocable, stored hashed. What that meant for pairing a child's tablet, and what to ask.
Can one customer see another's prices in your B2B portal?
A portal asked for one customer's prices and got everyone's, because the server ignored the request. How to check yours, and how we closed it.
Python assert in production: not a security check
Python can strip every assert from a production build, and the guard with it. How we caught a login endpoint fenced off by one, and what to ask your team.
Certificate management software: who can see whose records?
Staff certificate portals often check what a user may do, not whose records. How to test your own software, and what we found in one system we audited.
Online quotation link: can customers see your margin?
A no-login quote link can show costs the PDF never would if it is built separately. The cause, the check to run before you send one, and what happened to ours.
A database view can bypass row-level security. Here is how
In PostgreSQL a view runs as its owner, so it can ignore row-level security and sum every customer's data. How we caught it before launch, and what to ask.
Bulk upload: can staff skip permissions with a spreadsheet?
A clerk who could only upload spreadsheets created customers and products she could not add by hand. How to check yours, and why one bad row stops uploads.
Can a generated API client send the wrong credentials?
Yes: a client generated from a schema copies what the schema states and guesses the rest. Ours guessed one credential pair backwards. How to catch it.
Signed out but the login still works for hours? Why
If signing out only clears the screen, a copied login stays valid for hours. A real case, eight hours, plus what to check and what has to change on the server.
Audit log stored passwords in clear text: what to check
An audit log hid the request but stored old and new passwords in clear, then showed a password change as no change. How to check your own log.
POS inventory: a sale booked from a store with no till
A POS rule skipped for account owners let a sale be booked from a store with no till. How POS stock rules go wrong, and how to test yours.
WordPress hacked again after cleanup but the scan is clean
Hacked again after cleanup while the scanner says clean? Scanners match appearance. Comparing every file with the official release found 211 files they missed.
One site hacked, every site down? Check shared passwords
One site was hacked and every site on the server fell because they shared a database password. How to check yours, and the order to fix it in.
Sites sharing a server: how to stop one hack reaching all
Several websites ran as one user on one server, so one hack reached all. How to check your hosting, and what separating the sites changed.
Restrict data export by branch: the check most miss
Every screen limited a branch manager to one branch, but the export did not. How to check what your staff can download, and what closing the gap took.
Access denied on a record you can see in the list
Staff saw a record in the list, then got not found on opening it, because a branch check compared two different kinds of value. How to find and fix yours.