Example investigation
A suspected invoice export authorization gap, assessed against a repository revision.
These reproduction steps are the researcher's account of what happened.
An authenticated customer with invoices:read can request another account's invoices through the export endpoint.
In this synthetic case, the route is registered in the billing API and calls its invoice data layer. That connects the allegation to the server handling the request. The production revision and gateway configuration still need checking.
The export handler accepts account_id from the request and passes it to the invoice query. The inspected session and scope checks do not bind that identifier to the caller's account. The refund route has an account-ownership check, but that check does not protect the export route. These observations support a likely-supported assessment of the export claim. Deployed behavior remains unverified.
Locations inspected during the investigation. The assessment explains their relevance to the report; the refund safeguard does not resolve the export allegation.
Revision 9f31c7ad4b6e5c0284f1a9de3b7c650ad4e18f22
internal/http/routes.go · lines 7–13
Registers the reported export route and the middleware applied to it.
Revision 9f31c7ad4b6e5c0284f1a9de3b7c650ad4e18f22
internal/http/invoices.go · lines 7–18
Accepts the caller-supplied account identifier and passes it to the invoice query.
Revision 9f31c7ad4b6e5c0284f1a9de3b7c650ad4e18f22
internal/http/middleware.go · lines 10–36
Checks the session and permission scope, without binding the requested account to the caller.
Revision 9f31c7ad4b6e5c0284f1a9de3b7c650ad4e18f22
internal/billing/store.go · lines 7–18
Queries invoices using the supplied account identifier; deployment-level database controls remain unverified.
Revision 9f31c7ad4b6e5c0284f1a9de3b7c650ad4e18f22
internal/http/refunds.go · lines 8–20
Checks account ownership on refunds. This separate route does not establish protection for exports.
No human disposition or severity has been recorded. A reviewer still needs to assess deployment controls and decide how to validate the reported behavior.
An authorized test in a controlled environment can check the reported behavior. A proposed regression test alone does not establish deployed exploitability. No fix, deployment or remediation verification is recorded in this example.
Keep the investigation, conversation and human review together.