Start with the orders API. operator-a and operator-b are both customers.

Four order routes mapped. GET /api/orders/:id takes a numeric id and checks the session, not the owner. Testing it as operator-a against an order that belongs to operator-b.

Confirmed. operator-a reads order 1043, owned by operator-b. Filed F-001 as critical. The proof-of-concept request is in the repeater.

Anything on the avatar import?

It fetches any URL the server can reach. An internal address fails in 3 ms, an unreachable one in 2 s. Filed F-002 as high. Internal hosts are out of scope, so I stopped there.

Search next. Then the export route.

The q parameter shows up unencoded in the 500 page. Filed F-004 as medium. Export needs the support role. Trying it as a customer now.