aaronjmars/mike

Activity

Themed changes and pull requests touching this fork, newest first. Themed changes that haven't been turned into a public post yet still appear — they're real work even without a published writeup.

📝 IDOR fix: tabular review endpoints now check document ownership before accepting IDs 0 commits — securitydiscovery draft

Threads of work (detailed view)

1 thread have been distilled into posts.

IDOR fix: tabular review endpoints now check document ownership before accepting IDs

Four tabular review endpoints accepted user-supplied document IDs without verifying ownership, so a signed-in user who knew a document UUID they didn't own could trigger LLM extraction against it and read the results back through a review they controlled. aaronjmars closed all four paths with a single access-filter helper.

securitydiscovery