Security review · prepared locally

Fieldnotes · customer portal

example / a1b2c3d

Accounts, team data, and customer exports. A fictional review showing what useful evidence looks like.

Test environment: Local test app with two fictional teams

What was checked

5 of 7 checks performed · 1 finding recorded

Prepared locally from the supplied observations. This kit does not send data to DeepNoodle or independently verify findings. A completed check is not a guarantee that a feature is secure.

Findings and next steps

high · Reproduction reported

1. A signed-in user can download another team’s export

src/routes/exports.ts:42

Expected
Only members of the team that owns an export can download it.
Observed
An account in Team Birch received a CSV belonging to Team Maple when it requested Maple’s export ID.
Safeguards considered
The route checks that the user is signed in. Shared middleware does not check team membership. Export IDs are hard to guess, but are not an access rule.
Repeat the test
Create one export as Team Maple. Sign in as a member of Team Birch and request that export ID. Compare the returned team and file contents.
Suggested fix
Look up exports using both the export ID and the current user’s permitted team IDs. Reject requests when no matching export is found.
Retest
The owning team should receive its file. Another team and a signed-out request should not. Add both cases to the route tests.

Evidence

Fictional test observations
Owner account → GET /exports/export_maple → 200
Other team account → same request → 200
Signed-out request → same request → 401

Coverage and gaps

Checked

Check who can see and change each record

Compared export requests from two team accounts. The endpoint checks sign-in, but the export lookup does not check team ownership. See the finding.

Checked

Check admin actions without using the buttons

Reviewed the relevant local code and test cases in this fictional example. No additional issue was recorded.

Checked

Check what happens to uploaded files and links

Test uploads stayed private. File links required a signed-in account in the fictional test environment.

Checked

Set limits before the bills start adding up

Reviewed the relevant local code and test cases in this fictional example. No additional issue was recorded.

Checked

Keep private API keys out of public code

Reviewed the relevant local code and test cases in this fictional example. No additional issue was recorded.

Not started

Check security alerts in the libraries you use

No observation recorded.

Blocked

Check the settings of the running app

The deployed settings were not available. Ask the owner to review storage permissions and debug settings.