Confidence your backend is secure.
Repeatable checks. Proof you can audit.

Root Cause

Membership deletion doesn't invalidate the cached permissions.

The Bug

// removeMember deletes from DB but cache stays valid
await db.membership.delete({ where: { userId } });
// BUG: cache.invalidate() never called

Root Cause

Webhook handler processes events without checking if already handled.

The Bug

// Stripe retries webhooks, this runs multiple times
async function handlePayment(event) {
  // BUG: No idempotency key check
  await db.payment.create({ amount: event.amount });
}

Root Cause

API endpoint fetches by ID without checking tenant ownership.

The Bug

// Document fetch without ownership check
async function getDocument(req) {
  const doc = await db.document.findUnique({
    where: { id: req.params.id }
    // BUG: No organizationId filter
  });
}