Developer builds authorization layer below app code, invites public to break it
A developer has publicly released a live demo of an insurance claims app called Sentinel, challenging users to breach its access control system using provided credentials and curl commands. Unlike conventional B2B apps that scatter authorization logic across endpoints and components, this system enforces access rules at the infrastructure level, before any application code executes. The demo runs two fictional insurers — Northwind Mutual and Cascade Assurance — on a single deployment, testing both field-level security and tenant isolation. Visitors can verify that policyholders never receive sensitive fields like fraud scores or internal notes, and that each insurer's claims data remains invisible to the other's staff. The developer argues that embedding authorization in application code is inherently fragile, as any single forgotten endpoint can cause a data leak serious enough to warrant a CVE.
