Aerrol John“Kiyo”Jimenez

Before launch, I attacked my own app.

Three of the findings, replayed against the app as it was, then again after the fix.

1. Replay 01: the attack worked before the fix, and is blocked after it.

   replay 01runningexploitedblocked

   $ replay 01 --as staff

   > auth.updateUser({ data: { role: "super_admin" } })

   < token refreshed · is_super_admin() -> true

   — fix: the role check reads the users table only

   $ replay 01 --as staff

   < get_user_role() -> staff

   Found

   A role check trusted a profile field that any user can rewrite.

   Fixed

   The role check now reads only the users table.

2. Replay 02: the attack worked before the fix, and is blocked after it.

   replay 02runningexploitedblocked

   $ replay 02 --anon

   > auth.signUp({ email, password, options: { data: { role: "super_admin" } } })

   < account created · role super_admin

   — fix: signup ignores any role in the request

   $ replay 02 --anon

   < role in the request ignored · new accounts start as staff

   Found

   Signing up could hand a new account any role it asked for.

   Fixed

   New accounts can no longer pick their own role.

3. Replay 03: the attack worked before the fix, and is blocked after it.

   replay 03runningexploitedblocked

   $ replay 03 --as staff

   > from("receipts").update({ receipt_json: … }).eq("id", id)

   < 1 row updated

   — fix: receipts are insert-and-read only

   $ replay 03 --as staff

   < 0 rows updated · receipts are read-only

   Found

   Receipts could be rewritten after the sale.

   Fixed

   Receipts are immutable once issued.