The highest-impact bug class in B2B SaaS is still authorization
Broken object-level authorization and tenant isolation failures outrank every injection class we find. Here is how we test for them, and why scanners miss them entirely.
Ask a scanner to test a multi-tenant SaaS product and it will report missing headers, an outdated library, and possibly a reflected XSS in a search parameter. It will not report that a valid user on tenant A can read tenant B's invoices by changing an identifier, because the scanner has no idea what a tenant is.
Why tooling cannot see it
Authorization bugs are semantic. A request that returns a 200 with valid-looking JSON is indistinguishable from a correct response unless you know which data the caller was entitled to. That requires understanding the product's permission model, which roles exist, what each is supposed to reach, and where the boundaries are drawn.
How we test it
- Provision at least two independent tenants with realistic data in each
- Provision every role within each tenant: owner, admin, member, read-only, billing and any custom roles
- Enumerate the full API surface from an authenticated position, including endpoints the UI never calls
- Replay every request cross-tenant and cross-role, then diff the responses rather than trusting status codes
- Test indirect paths: exports, webhooks, invitations, search indexes, audit logs, and support tooling
That last category is where the worst findings live. Product teams reason carefully about the primary read path and then leak the same data through a CSV export, a notification email, or an internal admin view that authenticates but does not authorize.
What to fix structurally
Patching individual endpoints does not solve the class. The durable fix is to make authorization impossible to forget: enforce tenancy at the data-access layer, make the tenant context a required parameter rather than an ambient one, and fail closed when it is absent.
If a developer can write a query that omits the tenant filter and it still compiles, you will eventually ship one.
Add a test that asserts cross-tenant access fails for every resource type, and run it in CI. It is one of the highest-value tests a B2B SaaS product can have.