beginner · investigation
The Invoice That Belonged to Someone Else
A customer reports seeing a different company’s invoice.
Evidence
GET /invoices/7842 200 principal_tenant=A record_tenant=B
Investigate
Inspect Authentication
Session was valid.
Inspect Repository query
Loaded by invoice id without tenant predicate.
Inspect Cache
Key also omitted tenant id.