What a scoped human review actually delivers.

Evidence

Using the approved org-a-member role, GET /api/projects/8121 returned a project record owned by Organization B (HTTP 200, full record). The handler verifies that the caller is authenticated but never checks that the project's organization matches the caller's membership.

Business impact

Any authenticated member of any organization can read other organizations' project records by enumerating sequential IDs. In the trigger context — an enterprise prospect's due-diligence questionnaire — this is exactly the class of failure the prospect is asking about.

Remediation

Add an organization-membership predicate to the server-side query (project belongs to one of the caller's organizations) and return 404 rather than 403 to avoid ID enumeration. Apply the same predicate to the related export endpoint.

Scope and limitation

Reproduced in the staging environment with approved test tenants and the recorded request budget. Tokens redacted.

Retest: Fixed and retested 2026-07-18 — cross-tenant requests now return 404.

Evidence

The UI hides the role-change control from non-admins, but the server accepts the request from any authenticated organization member. With the org-a-member role, POST /api/members/{id}/role with {"role":"admin"} returned 200 and elevated a second test user.

Business impact

Privilege escalation within an organization: any member can grant admin to themselves or others, then manage billing, invitations, and exports. Client-side hiding is presentation, not authorization.

Remediation

Enforce the admin requirement server-side in the role-change handler. Audit existing role assignments for unauthorized changes, and alert on role changes not performed by a current admin.

Scope and limitation

Validated with approved test users in the staging tenant. The test changes were reverted immediately after the check.

Retest: Fix in progress — not yet retested.

Evidence

In the reviewed code path, the reset handler validates the token signature, but no expiry or single-use check appears before the password update. The auth-provider configuration that may enforce expiry server-side was outside the agreed scope.

Business impact

If no expiry or single-use enforcement exists elsewhere, a captured or leaked reset link could be replayed to take over an account.

Remediation

Confirm where expiry and single-use enforcement happen (application code or provider). If absent, enforce a short TTL, invalidate the token on use, and log token-reuse attempts.

Scope and limitation

Source path reviewed. Provider configuration and runtime replay were not exercised — replay testing of recovery flows was excluded at the customer's request.

Retest: Requires owner verification of the provider configuration.

Evidence

The session cookie is set with Secure and HttpOnly, without a __Host- prefix, and with SameSite=Lax.

Business impact

A hardening gap, not a demonstrated vulnerability. The current attributes already block the most common cookie-theft paths in this deployment.

Remediation

Adopt the __Host- prefix and SameSite=Strict for the session cookie if all supported browsers are within the support window; verify login and logout flows afterward.

Scope and limitation

Observed on responses within the agreed scope.

Retest: No retest required — hardening recommendation.

Evidence

Excluded from the written scope at the customer's request. The webhook handler was neither reviewed nor exercised.

Business impact

No conclusion can be drawn. Webhook authentication is a common failure point and should be covered in a follow-up scope.

Remediation

Add the webhook handler to a follow-up review scope, or verify signature enforcement, replay protection, and idempotency owner-side.

Scope and limitation

Outside the signed scope.

Retest: Needs a follow-up scope.

Evidence

Row Level Security policies were reviewed only for the tables touched by the scoped project and membership workflows. Other tables were not assessed.

Business impact

No conclusion about the rest of the schema. A source-backed pass can inventory the remaining tables and their policy coverage.

Remediation

Inventory exposed-schema tables and confirm RLS enablement and policy coverage, or extend the next review scope.

Scope and limitation

Outside the signed scope except for the tables named in this report.

Retest: Needs an extended scope.