Mock Reviews

Ranked by severity, likelihood and blast radius:

1. Anyone can join any workspace (bugs 9, 1, 6, 4). The pending-invites endpoint has no membership check (1) and returns each invite's token (9), so any logged-in user can list another workspace's invites and accept one. Tokens also leak through the logs (6) and are guessable (4). Fix: membership check on the list route, never return or log tokens, cryptographic tokens stored hashed. Prevention: treat tokens like passwords; a test that a non-member gets 404.
2. Privilege escalation (bug 2). Any admin can invite an owner. Fix: schema-validated body, roles capped at the inviter's.
3. Invite reuse and expiry (bug 8). A double click or a forwarded link adds two memberships, and expired invites still work. Fix: one conditional UPDATE … WHERE accepted_at IS NULL AND expires_at > now() in the same transaction as adding the member.
4. Seat limit bypass (bugs 10, 3). Pending invites aren't counted, and concurrent invites race the count. Fix: count members plus pending invites under a row lock, and recheck on acceptance.
5. Email case mismatch (bug 5). Real users can't accept their own invites. Fix: normalise on write.
6. Silent email failures (bug 7) and the test that can't fail (bug 11), which is why the seat bugs weren't caught.

1. Overdrafts and unrecorded payouts (bug 9). Two withdrawals can both pass the balance check, and a crash between payouts.send and the debit pays out money that's never deducted. This is direct financial loss. Fix: atomic conditional debit first, then the payout with an idempotency key, with a compensating credit on failure.
2. Webhook signature (bug 5). Verifying re-serialised JSON can reject real webhooks or accept tampered ones, and the comparison leaks timing. Fix: raw body + timingSafeEqual.
3. Double credits and lost credits (bugs 8, 7). Redelivered events credit again; concurrent ones overwrite each other. Fix: processed-event table with a unique constraint plus an atomic increment, in one transaction.
4. Wrong amounts (bugs 6, 1, 3). Credits are 100× too small; top-up amounts are never validated; all top-ups share one reference. Fix: integer paise validated at the boundary, a top-up record whose ID is the reference.
5. Provider failures (bugs 4, 2): unchecked res.ok and no timeout.
6. The test (bug 10) passes with the 100× bug present, which is why it shipped.

1. Cross-tenant data leak (bug 3). Export IDs travel in emails and links; anyone logged in with an ID downloads another company's orders. Fix: scope the lookup to the caller's tenant. Prevention: never serve files by a client-supplied name; store the path on a tenant-scoped record.
2. CSV formula injection (bug 7). Opening the export can run attacker-chosen formulas on an employee's machine, and unescaped commas corrupt the file. Fix: proper CSV quoting plus formula-prefix neutralising.
3. Incomplete or wrong exports (bugs 1, 5). The last day is missing, and rows are skipped or duplicated while orders arrive. Finance will reconcile against this file. Fix: half-open date range and keyset paging.
4. Reliability (bugs 2, 4, 6). Queued exports are lost on deploy, one failure crashes the worker, and large tenants run it out of memory. Fix: durable jobs, error handling per job, streaming.
5. Ambiguous timestamps (bug 8).
6. The test (bug 9) uses data too small and too tidy to catch any of the above.