Tenant Isolation Testing
Mandatory cross-org tests: Org A data must never leak to Org B.
User goal
Prove multi-tenant boundaries hold on every new endpoint.
- Tier
- All releases
- Nav label
- N/A
- Route
- /projects/{project}
- Gates
- —
QA focus
- IDOR on every new route
- API tokens scoped to org
- Jobs receive organization_id in payload
Overview
Tenant isolation is mandatory on every release. Org A data must never leak to Org B — treat IDOR checks as non-optional on new endpoints.
What you get
- Clear tenant key:
organization_id - Policy rule: compare
user.organization_idtomodel.organization_id - Coverage targets: web routes, API tokens, and jobs that carry org context
How it works
- Never accept
organization_idfrom the client on writes - Log in as Org B and probe Org A project/scan IDs — expect 403/404 with no leaked body
- Confirm API tokens are org-scoped and jobs receive
organization_idin their payload
Interactive guide
Step of
What to do
Where to find it
Expected (pass)
Negative cases
Tips
Screenshot pending capture
All steps (reference)
-
Step 1. Cross-org project access
Log in as User B; paste Org A project URL.
What to do: GET /projects/{orgA_project_id}
Expected (pass)
- 403 Forbidden or 404 Not Found
- No data from Org A in response body
Negative cases (must fail safely)
- 302 redirect that confirms resource exists without auth
-
Step 2. Cross-org scan access
Open /scans/{id} for another org’s scan.
Expected (pass)
- 403/404
- No issues or URLs leaked
-
Step 3. API token scope
Token from Org A cannot read Org B project via API v1.
Expected (pass)
- 401/403 on cross-org API IDs