The /admin Users, Audit and Correlation views query without an org_id filter, so they return data across every org. routers/users.py:57-70 lists all Firebase users fleet-wide and never shows which org a user belongs to.
This is the same failure mode SAAS_PLAN.md flagged before the tenancy work, simply missed on the admin side during the org_id pass. It becomes a real leak the moment a second org exists.
The other half of the problem: no legitimate cross-org view exists either — no org list, no per-org usage. A platform operator has no sanctioned way to see the fleet, which is part of why the unscoped queries were not noticed.
Both halves need designing together: decide what a platform admin should see, build that deliberately, and scope everything else.
The `/admin` Users, Audit and Correlation views query without an `org_id` filter, so they return data across every org. `routers/users.py:57-70` lists all Firebase users fleet-wide and never shows which org a user belongs to.
This is the same failure mode `SAAS_PLAN.md` flagged before the tenancy work, simply missed on the admin side during the `org_id` pass. It becomes a real leak the moment a second org exists.
The other half of the problem: no legitimate cross-org view exists either — no org list, no per-org usage. A platform operator has no sanctioned way to see the fleet, which is part of why the unscoped queries were not noticed.
Both halves need designing together: decide what a platform admin *should* see, build that deliberately, and scope everything else.
Promoted to a hard revenue gate by board minutes #42 (2026-08-23) - this is Gate B condition B2.
No customer is charged until this is closed. The CISO (#39) ranked it below #13 on exploitability (platform-admin only, not customer-reachable) but flagged the real significance: routers/users.py:57-70 lists all Firebase users fleet-wide with no org indication, which means the platform side of tenancy was missed in the same pass that scoped the customer side. That makes it evidence the tenancy sweep was not exhaustive, which is why it is on the gate rather than in the general backlog.
Owner: CTO. Date: 2026-09-30.
**Promoted to a hard revenue gate by board minutes #42 (2026-08-23) - this is Gate B condition B2.**
No customer is charged until this is closed. The CISO (#39) ranked it below #13 on exploitability (platform-admin only, not customer-reachable) but flagged the real significance: `routers/users.py:57-70` lists all Firebase users fleet-wide with no org indication, which means **the platform side of tenancy was missed in the same pass that scoped the customer side**. That makes it evidence the tenancy sweep was not exhaustive, which is why it is on the gate rather than in the general backlog.
Owner: CTO. Date: **2026-09-30**.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The
/adminUsers, Audit and Correlation views query without anorg_idfilter, so they return data across every org.routers/users.py:57-70lists all Firebase users fleet-wide and never shows which org a user belongs to.This is the same failure mode
SAAS_PLAN.mdflagged before the tenancy work, simply missed on the admin side during theorg_idpass. It becomes a real leak the moment a second org exists.The other half of the problem: no legitimate cross-org view exists either — no org list, no per-org usage. A platform operator has no sanctioned way to see the fleet, which is part of why the unscoped queries were not noticed.
Both halves need designing together: decide what a platform admin should see, build that deliberately, and scope everything else.
Promoted to a hard revenue gate by board minutes #42 (2026-08-23) - this is Gate B condition B2.
No customer is charged until this is closed. The CISO (#39) ranked it below #13 on exploitability (platform-admin only, not customer-reachable) but flagged the real significance:
routers/users.py:57-70lists all Firebase users fleet-wide with no org indication, which means the platform side of tenancy was missed in the same pass that scoped the customer side. That makes it evidence the tenancy sweep was not exhaustive, which is why it is on the gate rather than in the general backlog.Owner: CTO. Date: 2026-09-30.