A client's multi-tenant SaaS had menus, routes, and role checks — all in the browser. The API behind it would happily serve any tenant's data to anyone with a valid session token. It took eight months for someone to notice.
- Published On
authorization
Tags
consulting (59)debugging (25)architecture (20)developer-experience (20)reliability (16)devops (12)ai (10)performance (9)observability (7)code-quality (6)technical-debt (5)database (5)security (4)productivity (4)kubernetes (4)postgres (4)databases (3)postgresql (3)infrastructure (3)tooling (3)microservices (3)testing (3)engineering-culture (3)dependencies (2)nodejs (2)code-review (2)deployment (2)opentelemetry (2)monitoring (2)ci-cd (2)javascript (2)goals (2)multi-tenant (1)authorization (1)terraform (1)dns (1)opinion (1)api-design (1)memory (1)configuration (1)error-handling (1)secrets-management (1)webhooks (1)resilience (1)containers (1)environments (1)queues (1)cloud (1)cost-optimization (1)orm (1)refactoring (1)on-call (1)alerting (1)incident-management (1)typescript (1)distributed-systems (1)caching (1)platform-engineering (1)feature-flags (1)api (1)contracts (1)logging (1)mongodb (1)migration (1)workflow (1)nestjs (1)angular (1)sandbox (1)sonarcube (1)learning (1)journey (1)mdx (1)