Cloud Region. Grant access by identity, not by wildcard.
2 labs, easiest first0 / 2
Shipping labels anyone can downloadSEC-318A researcher downloaded one of Northstar's shipping labels, with a customer's name and home address, from the label archive bucket without any credentials. The bucket holds every label since 2024.MediumFix 30 min · Linux
The deploy role that can do anythingSEC-322The access review found that the CI role every Waybill deploy assumes can do far more than deploy Waybill. Its policy was "temporary, for the migration", and then "narrowed" once. Nobody has compared it with what the pipeline calls.HardFix 35 min · Linux
