Needs your input
Map application2Validate controls3Assessment
1 host0 validatedConversationTest accounts · Approved scope
October 3 · Pentest started
Magier AII’m reviewing the billing API’s authenticated routes and checking whether invoice access is constrained to the active account.
Magier AIThe API exposes invoice and account resources. Nina Patel’s Meridian account and Owen Price’s Harbor & Pine account have separate ownership.
Application mapMapped
api.staging.meridian-commerce.example
Authentication
/auth/*MappedInvoices
/api/invoices/*In scopeAccount access
/api/team/*In scopeMagier AIMay I request Harbor & Pine Retail’s designated invoice while signed in as Nina Patel at Meridian Commerce? I’ll keep the request read-only.
Your approval is needed
Nina Patel · MeridianCurrent member sessionHarbor & Pine invoiceinv_2026_1048 · approved record
Read-only request- Why this check?
- Confirm whether the API enforces invoice ownership.
- Impact
- No data will be modified. Only the two approved test accounts are involved.
Magier AI will resume after your decision