The situation

Dana Whitfield joined Vantrix as its first security hire and inherited a scanner that produced 1,200 findings a quarter. Nobody could say which ones an attacker could actually use.

The exploit

After an identity migration, production accepted tokens from both issuers. The staging signing keys had been sitting in a public repo for six weeks. Feint forged a token, signed in as an admin and recorded the session.

# feint · token signed with the staging key from a public repo
iss:  https://auth.staging.vantrix.dev
sub:  admin@vantrix.io
role: org_admin

GET /api/admin/users
Authorization: Bearer eyJhbGciOiJSUzI1NiIs…
->  200

# feint · token signed with the staging key from a public repo
iss:  https://auth.staging.vantrix.dev
sub:  admin@vantrix.io
role: org_admin

GET /api/admin/users
Authorization: Bearer eyJhbGciOiJSUzI1NiIs…
->  200

# feint · token signed with the staging key from a public repo
iss:  https://auth.staging.vantrix.dev
sub:  admin@vantrix.io
role: org_admin

GET /api/admin/users
Authorization: Bearer eyJhbGciOiJSUzI1NiIs…
->  200

The fix

The pull request removed the staging issuer from the production allow list and added a test that fails if a second issuer ever returns. The team rotated the keys the same afternoon.

What changed

Vantrix now triages eleven findings a quarter, and every one comes with a working exploit. The auditor accepted the Feint report as evidence for the access-control controls.