Multi-tenant SaaS data leak exposes flaw in relying on query conventions for isolation

·1 views

The Bicitra education management system encountered a data leak where one school's information was accessible through seven endpoints. This occurred despite using a Prisma Client Extension to automatically inject tenant-scoping clauses into database queries. A nested 'include' relation bypassed this automated scoping mechanism. The developers implemented a structural fix by creating a central registry of tenant-scoped foreign keys, validated at write time, to protect new endpoints by default.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Bogotá apartment rental data reveals median price disparities across neighborhoods

Aptología released ten new open-data studies on Bogotá's apartment rental market based on October 2026 listings. The research shows median rents vary widely, from COP 1 million in Usme to COP 4.5 million in Chapinero. Furnished apartments cost nearly 23% more per square meter than unfurnished ones. Units that accept pets command a 7% premium, and higher-floor apartments are significantly more expensive.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

PostgreSQL & Node.js Techniques Prevent Inventory Overselling

A common concurrency bug called the lost update problem can cause online stores to oversell limited inventory during high traffic. This occurs when multiple transactions read the same stock level before any of them update it, leading to inaccurate decrements. The article demonstrates the issue using a Node.js and PostgreSQL environment where 50 concurrent purchase requests compete for 10 items. It then presents three solutions: conditional atomic updates, pessimistic locking, and optimistic locking. The appropriate method depends on the specific level of data contention in the application.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Compose Multiplatform on iOS: Memory Pressure from Skia-Metal Rendering

A technical article analyzes performance issues in Compose Multiplatform apps on iOS devices with limited RAM. It explains how the framework's Skia canvas uses Apple's Metal API for rendering, independent of UIKit. The integration of native UIKit components creates boundaries that force expensive GPU context switches, increasing memory pressure. On devices with around 3GB of RAM, such as the iPhone XR, these compositing decisions can trigger memory spikes and cause dropped frames in production.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI and IoT bridge data gaps for visibility in automotive manufacturing

Automotive manufacturing faces a visibility challenge due to operational data fragmented across multiple separate systems. This fragmentation hinders a unified, real-time view of factory operations, complicating tracking of vehicles, components, and processes. Technologies like AI, IoT, RFID, and real-time location systems can connect physical operations to digital systems. These technologies enhance traceability, improve tracking of assets across assembly stations, and support smarter production decisions.

0 comments Read more at DEV Community