Alexander Vassbotn Røyne-Helgesen PRO
Lover of life, technologist at heart
Security briefing
What the architecture discovery found, what to confirm in production, and what to do first.
Alexander · Tech Lead
What this is, and what it is not
- BasisCode and configuration onlyA static, read-only review, plus cloud settings read on 14 October. Nothing was tested.
- UnknownReal exposureIt depends on edge controls we cannot see in the repositories. That is the first thing to confirm.
- HandlingConfidentialNo secret values are included. Details stay with the people who verify and fix.
Every P0 is a candidate until it is confirmed in production.
One root cause behind most findings
14P0 candidates, if confirmed in production
133write routes that accept requests without login
1shared key that can act as a user in any tenant
0findings tested against live systems
Authentication is opt-in, and the caller decides which tenant it is. Routes are open unless someone closes them, and the tenant comes from a header or host, not from the verified login.
Confidential. Static review of 19 repositories, snapshot 2026-10-11, refreshed 2026-10-13; cloud configuration read 2026-10-14. Nothing tested against live systems.
01
P0 candidates
Logins can be issued or reused across tenants
| ID | Finding | Potential impact |
|---|---|---|
| SEC‑01 | An endpoint without authentication issues long-lived login tokens for a given username | Account takeover in any tenant |
| SEC‑02 | Tokens are not bound to a tenant; the tenant comes from the request | A token from one tenant may act in another |
| SEC‑03 | One shared API key authenticates as the first user of any tenant | Full cross-tenant access if the key leaks |
First move: block the token endpoint at the edge, inventory who holds the shared key, then rotate.
Data can be changed without logging in
| ID | Finding | Potential impact |
|---|---|---|
| SEC‑24 | Anonymous write APIs on public hosts: planning, requests, quotations, Bus Network sync | Anyone can change operational and sales data in any tenant |
| SEC‑25 | SMS and email can be sent through a tenant's provider without login | SMS cost abuse; phishing from a customer's sender |
| SEC‑28 | Upload and download links for any tenant's file storage, without login | Arbitrary uploads; downloads of known files |
First move: take the internal scheduler off public hosts and require login on file links. Both are edge or config changes.
Satellites let the client pick the operator
| ID | Finding | Potential impact |
|---|---|---|
| SEC‑04 | Bus Network takes the company from the request; some routes are protected only by a key in the browser | Cross-operator data access |
| SEC‑07 | A Customer Portal route has no user authentication | Disclosure of a user's organisation access |
| SEC‑08 | Customer Portal picks the target operator from the request and calls TEQ with one shared master token | A user of operator A may act on operator B |
| SEC‑09 | The public API proxy forwards partner tokens to a host taken from the request | Partner tokens sent to a host an attacker chooses |
Secrets sit in git and in logs
| ID | Finding | Potential impact |
|---|---|---|
| SEC‑05 | Policy-service credentials committed to git | Policy store and token signing compromised, if values match an environment |
| SEC‑06 | Kubernetes secrets printed in CI logs; a database URI logged by the policy service | Anyone with log access can read secrets |
| SEC‑10b | Tokens and secrets printed to CloudWatch by gateway functions | Reusable credentials for anyone with log access |
First move: rotate, remove the printing, purge logs and git history, and turn on secret scanning.
02
New since 11 October
The infrastructure confirms the gaps
| ID | Finding | Potential impact |
|---|---|---|
| SEC‑44 | Production database reachable from 33 internet address ranges (confirmed live) | Direct database access from outside AWS |
| SEC‑45 | Infrastructure changes apply on merge with static cloud keys; one self-approvable approval | Weakly reviewed changes to production |
| SEC‑46 | Cluster management API open to the internet (confirmed live); no secrets encryption or audit logs | Larger attack surface, no trail |
| SEC‑47 | Infrastructure state committed to git inside old plan files | Resource details, possibly secrets, in history |
| SEC‑48 | All environments run in the organisation's main account, with one deploy key | Dev access reaches production's account |
Checked live: production backups and deletion protection are on, and bastions exist.
One improvement, five new findings
- ImprovedPublic API checks scopesThe shared key no longer works there.
- SEC-41Clients linkable without scopesA tenant can grant lasting API access.
- SEC-42Long-lived cloud keysIn three services; reach unknown.
- SEC-43Tokens in git historyTwo GitHub tokens, one Google key.
- SEC-49CI actions not pinnedOne compromised in 2025 deploys prod.
- SEC-45, 16Weak prod approvalsSelf-approval allowed, any branch.
One CI role can take over the cloud account
- WhatFull admin, any repositoryA deploy role with administrator rights that every repository's workflows can use.
- Why it mattersShortest path to everythingOne compromised workflow could control the account that runs production.
- First moveNarrow it, then remove adminOne role per repository and environment, with only the rights it needs.
Check first: which workflows use it, so nothing breaks. Then change it, after a reviewed dry run.
Cancelling an order can change another operator's data
- WhatThe cancel switches operator midwayFor orders with trips shared from another operator, the rest of the cancel runs in that operator's data.
- Why it mattersNormal use, wrong customerTheir trips, order and payment links can be changed, and their drivers told trips are cancelled.
- First moveSmall fix, then a data checkFix the code with a test, then look for affected orders and repair them.
A defect, not an attack. It needs no attacker, which is why it may already have happened. The data check tells us.
03
Confirm and contain
Six checks, no testing against production
- Edge: which exposed paths are reachable?
- Access logs: anonymous hits, last 90 days
- Secrets: do leaked keys match? Who reads logs?
- Tenants: do user IDs overlap?
- Databases: backups, public access, open ports
- Orders: cancels that reached another operator
Rotate three sets of credentials now
- SEC-40 · Ferd web appThird-party API credentials in git historyCommitted in an AI-assistant chat log. Rotate with the provider, then scrub.
- SEC-05 · Policy serviceCredentials and signing secret in gitRotate, purge from history, check whether they matched an environment.
- SEC-43 · Shared packagesTwo GitHub tokens and a Google key in historyRevoke the tokens, restrict the key, publish packages from CI.
Cheap and reversible. All three are in git whatever production looks like. Add a rule that chat logs and tokens are never committed, enforced by secret scanning.
Next in line after the P0s
- SEC-10, 26Weak object-level checksLogged-in users can act on records that are not theirs.
- SEC-11, 29, 30Exposed toolingAdmin, translation editor and debug tools, plus a policy bypass.
- SEC-16, 17, 22Environments and CILong-lived keys, staging and prod share a cluster, no WAF.
- SEC-34, 35Driver appSMS credentials sent to devices; tokens sent to third parties.
- SEC-19, 23, 27Secrets in logsTenant secrets in one database; keys and personal data in logs.
- SEC-36 to 39Apps not yet liveFerd and the map service: fix before launch.
Confirm, contain, fix, then make it the default
- Days 0–2Review the briefing. Run the six checks.
- Days 2–5Edge containment. Start rotating credentials.
- Week 2Code fixes in satellites. Plan for safe defaults, log-only first.
- OngoingTracked in the roadmap, and as ISO 27001 evidence.
Every first step is reversible. Edge rules can be rolled back, rotation only replaces values, and behaviour changes ship behind flags.
Four things to settle before the checks run
- Who runs the checks, and by when
- Who decides if something is an incident
- Who handles GDPR notification if data was accessed (72 hours)
- Which vendor leads we need for the satellite fixes
If the checks show unauthorized access, incident and data-protection duties apply. That assessment is outside this technical review.
Questions
Alexander · Tech Lead
Ferdia CTO: Security briefing for October 2026
By Alexander Vassbotn Røyne-Helgesen
