← All sheets
GL-S-030Sheet 030RECORDS · SECURITY

27 findings in one afternoon. None exotic. All ticking.

NCR 027 · ONE AFTERNOON · MULTIVENDOR MARKETPLACE · AUDIT

Drawing sheet 030: 27 findings in one afternoon. None exotic. All ticking.

General notes

  1. 01A raw query in one model. CORS wide open. Debug mode on in production. Wallet writes without locks. Refunds without transactions.
  2. 02All ticking, none yet detonated. We had chased features instead of fundamentals.
  3. 03The fixes took days. The lesson took an afternoon to learn and years to keep: stop, and audit, before the users do it for you.
27
Findings in one afternoon · 0 that had reached a customer · all closed before launch

As posted

27 findings in one afternoon. None exotic.

A raw query. CORS wide open. Debug on in production. Wallet writes without locks. Refunds without transactions.

All ticking. None detonated. We'd chased features, not fundamentals.

An afternoon to find. Months of debt. Sheet 030.

Read with

  • Sheet 018 · Five bugs. Months apart. One bug.