Getting started

Tough Crowd

Caution

Not safe to merge — correctness found 1 blocker and 1 warning.

correctness · Not safe to merge

_{Reviewed 9e8d7c6 2026-10-13 16:06 UTC · View session}

Blocking (1)

1. Customers can read other customers' orders src/api/orders.ts:42 · open since run 1 (9e8d7c6) The new order endpoint looks up the order by ID without checking that it belongs to the signed-in customer, so any customer can read another customer's order by changing the ID. To unblock: Include the customer ID in the lookup and return not found when the order belongs to someone else.

   Full finding

   The new order endpoint looks up the order by ID without checking that it belongs to the signed-in customer, so any customer can read another customer's order by changing the ID.

Warnings (1)

1. A retried refund can be issued twice src/api/refunds.ts:77 · open since run 1 (9e8d7c6) The refund handler calls the payment provider before recording the refund, and retries the whole handler on timeout. Recommendation: Send an idempotency key derived from the refund ID with the provider request.

   Full finding

   The refund handler calls the payment provider before recording the refund, and retries the whole handler on timeout.

Run history (1 run)

Severity	Raised	Resolved	Open
Blocking	1	0	1
Warning	1	0	1
Notice	0	0	0

Converging. 0 of 2 findings are resolved. 1 blocker and 1 warning remain open; 1 blocker still prevents merge under the current policy.

Run	Head	Reviewed (UTC)	Blocking	Warning	New	Resolved
1	9e8d7c6	2026-10-13 16:06	1	1	2	0

_{Updated 2026-10-13 16:06 UTC}