Findings

Hard-coded service-account secret in repository

Authentication bypass via JWT none-algorithm acceptance

SQL injection via raw query in admin search

Server-side request forgery in webhook delivery

Missing authorisation on order export endpoint

Stored XSS in customer notes (admin view)

IDOR on order export — cross-tenant read

Missing Rate Limiting on API Endpoints

View Count Inflation via Header Manipulation

Incomplete Account Deletion

API Cost Abuse in Session Publishing

XML Injection in Markdown Export

Open Redirect in OAuth Flow

Insecure JWT signing key derived from env defaults

XSS via unescaped customer notes in admin UI

Cryptographic operation uses MD5 for password reset tokens

Misconfigured CORS allows any origin with credentials

Open redirect on post-login URL parameter

Sensitive endpoint reachable without authentication

Missing rate limit on login endpoint

Access Token Exposed in URL Query String

Sensitive Data Exposure in Error Logs

Plaintext Token Persistence in CLI Auth

Undisclosed Third-Party Data Sharing

Missing Clickjacking Protection

Verbose error responses leak stack traces in production

Secrets logged in payment retry handler

Missing rate limit on password reset request endpoint

Verbose 500 errors leak Django stack traces

Cookie set without `HttpOnly` / `Secure` flags

Broken Authentication in CLI Poll Flow

Repository contains stale test fixtures with real customer data