invoice = invoices.find(params.id)
return invoiceThe lookup trusts a client-controlled identifier after confirming only that the caller is logged in.
Synthetic deliverable · inspect every layer
Interactive sample web and API penetration test report.
Evaluate the executive decision, technical proof, remediation path, and re-test record before choosing a provider. Every system, account, identifier, and finding below is fictional and exists only to demonstrate the reporting standard.
- Synthetic evidence
- Controlled accounts
- No client claims
Interactive evidence trail
Change perspective. Keep the evidence intact.
Leadership needs decisions. Engineering needs exact reproduction. Both should trace back to the same verified observation.
Decision view
HIGHCross-tenant access breaks the product’s trust boundary.
A standard user in one controlled tenant can retrieve an invoice belonging to another controlled tenant by changing an object identifier. The server confirms authentication but does not enforce object ownership.
01Valid user sessionCommon prerequisite
→
02Change invoice IDNo privileged access
→
03Cross-tenant dataConfidentiality impact
- Affected surface
GET /api/v1/invoices/{id}- Required access
- Standard authenticated user
- Evidence boundary
- Two synthetic test tenants
- Priority
- Before affected release
Engineer view
HIGHAUTHZ-01 · Cross-tenant invoice access
Controlled request
GET /api/v1/invoices/inv_test_b HTTP/1.1
Host: app.example.test
Authorization: Bearer <tenant_a_test_session>
Accept: application/jsonObserved response200 OK
{
"id": "inv_test_b",
"tenant_id": "ten_test_b",
"status": "paid",
"total": 42000
}Reproduction path
- Authenticate as
user.a@tenant-a.example.test. - Request the controlled Tenant A invoice and record the normal request shape.
- Replace only the invoice identifier with
inv_test_b, owned by controlled Tenant B. - Observe that the API returns the Tenant B object instead of denying access.
Fix path
Root cause firstAuthorize the object, not merely the route.
invoice = currentTenant.invoices.find(params.id)
authorize(user, "read", invoice)
return invoiceResolve the object inside the authorized tenant boundary and enforce permission at the data-access layer.
Remediation acceptance criteria
- Cross-tenant identifiers return a consistent denial or not-found response.
- Equivalent invoice export, update, attachment, and bulk routes enforce the same boundary.
- Authorization tests cover standard, manager, and tenant-admin roles.
- Logs capture denied cross-boundary access without storing sensitive response data.
Closure view
FIXEDVerification records what changed and what was not re-tested.
Original200 OK
→
Tenant A session retrieved controlled Tenant B invoice.
RemediationOwnership enforcement
→
Object lookup constrained to the authenticated tenant.
Verification404 Not Found
Original request and adjacent controlled variants denied.
| Test | Expected | Observed | Status |
|---|---|---|---|
| Original cross-tenant read | Denied | 404 | Fixed |
| Same-tenant read | Allowed | 200 | Pass |
| Cross-tenant export | Denied | 404 | Fixed |
| Unrelated billing routes | Out of re-test scope | Not tested | Limited |
Complete illustrative deliverable
Download PDFReview the full 11-page PDF.
The PDF includes engagement metadata, controlled reproduction accounts, methodology, finding summaries, detailed evidence, risk context, and bounded re-test terms.
Turn your product into a testable scope
Build the brief before the sales call.
Map surfaces, roles, tenant boundaries, authentication, integrations, timing, and evidence needs in the guided scope planner.