Every finding arrives with a location, a severity and a fix.

Ranked by blast radius, grounded in the call graph, and written so the coding agent can act on it without a human translating first.

Pull request #284 / Add invoice lookup

api/invoices.py feature/invoice-lookup

Changed code+8 / -2

                  @router.get(/invoices/{id})
                
                  def get_invoice(id, user):
                
                   # Load the requested invoice
                
                   invoice = invoices.get(id)
                
                   return invoice.to_json()
                
                  # Response: application/json

api/invoices.py:24Exact location

Request contextAuthenticated user tenant A

The invoice lookup has no tenant constraint.

CloudAEyeCode review

CriticalA01 · Broken access control

One ID. Another tenant's invoice.

A signed-in user can request an invoice outside their tenant. Scope the lookup to the authenticated tenant before returning the record.

Suggested fixLine 24

- invoices.get(id)

+ invoices.get_for_tenant(
+ id, user.tenant_id
+
                    )

Tenant isolation test passedResolved