Latchform reviews the code that controls access to your product: permissions, sessions, integrations, and third-party packages. We trace a request through the application and give your engineers the steps to reproduce what we find.
Commission a focused review of one boundary before a release or a complete review across all four areas.
Check whether users can reach another tenant’s records or change data outside their role.
We trace caller identity from HTTP handlers into database queries, bulk endpoints, and background jobs, delivering a route-by-route ownership matrix and reproducible requests for any bypass.
Find out what the server accepts after sign-out, password changes, and account removal.
We replay active, rotated, expired, and revoked credentials against protected endpoints to verify whether access stops immediately on the server or remains open until a token expires.
Review signature checks, replay handling, and where each customer’s integration credentials are stored.
We inspect raw-body webhook signature verification, timestamp replay windows, and how outbound OAuth tokens and API keys are scoped to their owning tenant in background workers.
Trace vulnerable packages into the deployed build and the code paths that use them.
We verify whether a flagged package can be reached by production traffic, evaluate install-time and CI build exposure, and hand over verified lockfile upgrade diffs.
Each finding includes the request, test fixture and expected response so your engineers can reproduce it in their own environment.
Before launching a multi-tenant sharing or role model, after changing authentication or session handling, when adding webhooks or customer OAuth connections, or when triaging high-severity dependency advisories.
Using your route table and tenant model, we agree on the exact boundaries to inspect. We agree repository access and use a staging environment with isolated test tenants. Production access is outside that arrangement unless separately agreed.
Findings identify the relevant route handler, query or token check and include reproduction steps. Where appropriate, we propose a regression test for your team to run.
An illustrative finding showing the staging request, observed versus expected server behavior, and the query predicate fix with a regression assertion.
src/routes/orders/update.ts:48Authenticated as Tenant A administrator (usr_tnA_admin_01) with active session sid=ses_sample_active_09f2 targeting a Tenant B order record.
PATCH /v1/orders/ord_tnB_0912 HTTP/1.1
Host: staging.example.test
Cookie: sid=ses_sample_active_09f2
Content-Type: application/json
{
"status": "approved"
}Handler verifies the caller has the admin role, then runs UPDATE orders SET status = $1 WHERE id = $2. Tenant B's order ord_tnB_0912 is modified across tenant boundaries.
Update statement scopes by caller tenant: WHERE id = $2 AND tenant_id = $3. Matches zero rows in tnA_sample_01, returns 404 Not Found, and leaves Tenant B's record unchanged.
Bind the authenticated session's tenantId directly in the mutation predicate and assert cross-tenant rejection in the route test suite:
// src/routes/orders/update.ts
const result = await db.query(
'UPDATE orders SET status = $1 WHERE id = $2 AND tenant_id = $3 RETURNING id',
[body.status, params.orderId, session.tenantId]
)
if (result.rowCount === 0) return Response.json({ error: 'Not found' }, { status: 404 })
// tests/orders-authorization.test.ts
expect(res.status).toBe(404)
expect(await getOrderStatus('ord_tnB_0912')).toBe('pending')Step through all 24 combinations of session state, caller role, target tenant, and operation in the standalone policy simulator.
Open boundary labTechnical notes examining how session revocation and dependency reachability behave in application code.
Short-lived access tokens limit how long a revoked session can remain usable. Immediate revocation requires the request to consult revocation state, such as a session record or token denylist.
How we trace a package from lockfile resolution into production route handlers, and why a package with no production call path can still introduce risk during install, builds, or CI runs.