The situation

Solvio connects clinical systems over FHIR, and its first hospital customer set a hard date for HIPAA readiness. An external audit was already booked, leaving no room for a surprise.

The exploit

Two paths exposed protected health information. Export jobs wrote patient records to logs, and a consent scope could be widened by replaying a token against a second endpoint.

# feint · path 1: export jobs write PHI to logs
grep -c "patient_dob" /var/log/exports/2026-08-*.log
->  3,912

# path 2: replaying a narrow consent token on a second endpoint
POST /v2/consent/token    scope=records:read:self
POST /v1/records/search   Authorization: Bearer <same token>
->  200

# feint · path 1: export jobs write PHI to logs
grep -c "patient_dob" /var/log/exports/2026-08-*.log
->  3,912

# path 2: replaying a narrow consent token on a second endpoint
POST /v2/consent/token    scope=records:read:self
POST /v1/records/search   Authorization: Bearer <same token>
->  200

# feint · path 1: export jobs write PHI to logs
grep -c "patient_dob" /var/log/exports/2026-08-*.log
->  3,912

# path 2: replaying a narrow consent token on a second endpoint
POST /v2/consent/token    scope=records:read:self
POST /v1/records/search   Authorization: Bearer <same token>
->  200

The fix

Feint opened a pull request for each root cause. Each included a regression test, so the review was about the code and not about reproducing the bug.

What changed

The team finished in six weeks and went into the audit with evidence for both paths. The audit stayed on schedule.