A filter your API ignores is worse than a filter that returns an error
Two endpoints silently discarded the customer filter and returned every customer's pricing. The framework was doing what it documents, on every route, forever.
Topic
Security
Permissions, isolation, credentials, and failures that stay quiet.
13 articles
A permission called "read your own certificates" does not know whose certificates you are reading
The gate proves you may perform a kind of action. It says nothing about which rows, and in eight handlers the row restriction was eight copied lines.
The public quote link reuses the exporter, so it cannot leak anything the PDF would not
A no-login share link is a new way for internal costs to escape. Building it on the redaction the exporter already does removes a whole class of mistake.
A view runs as its owner, which is how row-level security gets bypassed by a report
Row-level security on the base tables does not protect a view over them. The default is owner privileges, and an aggregate leak looks like a slightly high number.
Bulk import is a second front door to every write endpoint you have
One permission to import, and the target resource named in the request body. That combination lets a role create records it has no permission to create.
Logging out cleared a variable in the browser, and the token stayed valid for eight more hours
There was a sessions table with a revocation column and a token hash. Nothing ever wrote a row to it, and nothing ever read one.
Redacting the payload and not the diff means you redacted nothing
The audit trail masked the request body and stored the before-and-after values in clear. Then the viewer rendered two masked values as "nothing changed".
The capability check ran for employees and skipped the owner, who chose the site himself
A middleware validated that a site could take till transactions. It returned early for account owners, and owners were the only ones who could name the site.
Signature scanning found nothing. File integrity found 211 malicious files
A malware scan that returns zero hits is not evidence of a clean site. Comparing files against the official distribution is what actually finds things.
The one convenience that turned a single breach into an estate-wide one
A shared password reused across every database on a server is not a weak password problem. It removes the boundaries you thought you had.
One shared process pool is how a single compromised site reaches all the others
Shared hosting is usually presented as a cost decision. It is a blast-radius decision, and the bill arrives all at once when one site falls.
Your permission model probably stops at the ORM and the CSV export walks straight past it
Row-level security kept tenants apart. Nothing kept a branch-scoped user from exporting the entire organisation's customers, orders and payments.
A permission check that was always false, and why nobody noticed for months
A UUID compared against a list of strings is never equal. The check failed closed, denied everything, and looked exactly like correct behaviour.