Confirmed access problem
GET /api/candidates/{id}
A signed-in user can view a candidate belonging to another customer.
Escalation statusEscalated
NotificationCTO notified
Current stateOpen
Discoveries and incidents
One place to see what needs attention.
Illustrative view · Updated after every check
All checkpoints
6 clear · 1 needs review · 1 monitoringCheckpointLatest resultStatus
Endpoint inventoryAPI documentation, code and deployed routes matchClear
New endpointsNo unapproved endpoints foundClear
Public accessPublic routes expose only approved informationClear
Sign-in protectionProtected routes reject missing or invalid sessionsClear
Role accessAdmin and standard-user permissions match the agreed rulesClear
Customer separationCross-customer access confirmed on one candidate routeReview
Sensitive informationResponses contain only the expected candidate fieldsClear
Deployment changesLatest release remains under observationMonitoring
What we check
The problems we are looking for.
The list combines endpoint access checks with the web application risks highlighted by OWASP.
New or hidden endpoints
Routes that appear in code or the deployed application without being recorded or approved.
Public exposure
Endpoints that can be reached without signing in when they should be protected.
Broken sign-in protection
Missing, invalid or expired sessions that are accepted by protected endpoints.
Wrong user access
Standard users reaching administrator actions or functions outside their role.
Cross-customer access
One customer viewing or changing records that belong to another customer.
Sensitive information
Responses revealing candidate details, internal fields or other data that should stay private.
Unsafe input
Requests that can inject commands, database instructions or unexpected values.
Unsafe configuration
Debug routes, old API versions, weak settings and missing limits that increase exposure.
How it works
Monitor, confirm, notify and escalate.
Checks run after code changes and deployments, as well as on a regular schedule. The team is contacted when a real problem is confirmed.
Monitor
Read the API documentation, code and deployed application. Notice new endpoints and changed access.
Confirm
Test the finding with the relevant user roles and customer accounts. Save the evidence.
Notify
Show what happened, which endpoint is affected and which change introduced it.
Escalate
Contact the CTO immediately for serious findings and track the incident until it is resolved.
How we do it
A background agent coordinates the checks, investigates changes and prepares clear reports. Repeatable tests provide the evidence. The service starts with read-only access and does not change application code.