The situation

Quilon moves money between marketplace sellers and buyers. With 24 engineers and no security hire, the team needed SOC 2 to close its next enterprise customers, and the auditor wanted evidence of a penetration test.

The exploit

A background export trusted the tenant id in the request body instead of the session. On its own, that looked like a low-severity issue. Feint chained it with a predictable job id and pulled 12 months of invoices from a test tenant, 41 minutes after the first attack started.

# feint · export started as tenant tn_2041
POST /api/exports  {"tenant_id": "tn_2041", "range": "12m"}
->  202 {"job_id": "exp_2041_0912"}

# job ids are predictable, tenant id is read from the body
GET /api/exports/exp_2042_0912/download
->  200 · invoices_tn_2042.csv · 1,284 rows

# first proven exploit: 41 min

# feint · export started as tenant tn_2041
POST /api/exports  {"tenant_id": "tn_2041", "range": "12m"}
->  202 {"job_id": "exp_2041_0912"}

# job ids are predictable, tenant id is read from the body
GET /api/exports/exp_2042_0912/download
->  200 · invoices_tn_2042.csv · 1,284 rows

# first proven exploit: 41 min

# feint · export started as tenant tn_2041
POST /api/exports  {"tenant_id": "tn_2041", "range": "12m"}
->  202 {"job_id": "exp_2041_0912"}

# job ids are predictable, tenant id is read from the body
GET /api/exports/exp_2042_0912/download
->  200 · invoices_tn_2042.csv · 1,284 rows

# first proven exploit: 41 min

The fix

Feint opened one pull request that scoped the export job to the session tenant and added a regression test covering every variant of the path. The team reviewed it like any other change and merged it the same day.

What changed

Every merge is now re-attacked in CI against the original exploit. Quilon handed the exploit, the fix and the passing test to its auditor and completed SOC 2 Type I without commissioning a separate pentest.