Keep each Xero request tied to the intended organisation
Concurrent jobs must not share mutable tenant context. Resolve and pass the connection explicitly so one organisation's work cannot be sent under another's identity.
Read articleCobnex blogs / Australia
Cobnex blog
AI implementation, software architecture, cloud operations and Australian technology policy.
512 articles
Page 20 of 29
Sync only the CRM fields the receiving service needs
A contact record can contain more information than an operational workflow requires. Limit both transport and destination access to the purpose of the integration.
Read articleVerify the signature before trusting the webhook payload
A public endpoint must establish who sent the request and which account it concerns. Valid JSON and a familiar event name provide neither assurance.
Read articleResolve rate-limit scope from trusted identity
A client-supplied account label must not choose an unrestricted budget or another tenant's queue. Keep scheduling scope tied to the authorised integration connection.
Read articleDead-letter access can expose failed customer payloads
Failed messages often retain the original request and diagnostic detail. Restrict inspection and replay according to the data and effects involved.
Read articleA queued schedule should not preserve revoked authority by accident
Scheduled work can run long after a user creates it. Define whether execution uses current requester rights or an explicitly authorised organisation process.
Read articleA shared tablet must not submit the previous user's work
Offline records need an account boundary that survives logout, reconnection and staff changes. Local possession of a draft does not establish current permission to submit it.
Read articleAn address lookup can reveal where your customers work
Review the information sent to lookup providers and stored in diagnostics. Address assistance should not quietly export access notes or unrelated customer details.
Read articleThe client can propose a price, but the server must authorise it
Amount validation includes who may choose the inputs and change the result. Correct decimal arithmetic does not protect an endpoint that trusts an editable browser total.
Read articleAsk for less, and protect what the form does collect
Form accessibility and data handling meet in the same workflow. Clear questions, scoped drafts and safe error messages reduce both confusion and unnecessary exposure.
Read articleHiding a table column does not restrict its data
Review the server response, exports and row actions as well as visible columns. Responsive presentation is not an authorisation boundary.
Read articleA recovered draft still needs current permission
Reauthentication proves an identity now. It does not automatically authorise an old action or transfer a previous user's saved work.
Read articleSearch relevance must be judged inside the user's permission boundary
Private documents should never compete for visibility with public results. Evaluate ranking only after the access model defines what the user may receive.
Read articleBuild dependencies inherit the build job's reach
Review credentials and network access where third-party code executes. A package excluded from production can still affect the software you deploy.
Read articleReview who can assume the role, not only what it can read
Trust policy and effective resource access form one boundary. Either side can expose data if reviewed in isolation.
Read articleKeep incident notes useful without copying secrets into them
Responders need evidence quickly, but the working record should not become a second store of credentials or unrestricted customer data.
Read articleA retention hold needs authority, scope and a release path
Exceptions can preserve necessary records, but an unowned hold can quietly suspend deletion forever. Treat creation and removal as controlled decisions.
Read articleThe hidden cost of permission-specific caches
Caching can reduce search and model costs, but protected answers cannot be shared just because the question text matches. Model the access boundary before choosing the cache key.
Read article