Multi-tenant access control: check the record, not just the role
A user may be allowed to view invoices and still be barred from one particular invoice. Here's how to test that boundary.
Read articlePeak Security / Blog
Security notes for people building products
We write about the security questions product teams run into while building: who can reach a record, what happens when access ends, and how to prove a fix worked.
When a user loses access, what still works?
What happens to an open session, pending invitation, or API token after someone leaves a team?
Read articleWhat makes a penetration test report useful to engineers?
A severity label is a start. Evidence and reproduction steps let engineers find and fix the issue.
Read article