I reviewed a dashboard last month where the delete action trusted the tenant id handed to it. No ...I reviewed a dashboard last month where the delete action trusted the tenant id handed to it. No ...
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Back to feedPost
Dusko's avatar
Dusko Licanin
pro
• Aug 2
I reviewed a dashboard last month where the delete action trusted the tenant id handed to it. No check, because the button calling it already sat behind auth.
That's the shape of all four Server Action CVEs this year, one a 10.0. The boundary moved off the client and the validation didn't follow.
Where I draw the line now → https://www.duskolicanin.com/blog/server-components-saas-patterns-2026
Next.jsReactTypeScript
Post image
Back to feed
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started