Legal API: business and filings endpoints should check account authorization
Open
bug
ENTITY - DO NOT USE
Priority2
security
- Dominant language
- JavaScript
- Stars
- 23
- Forks
- 62
- Avg merge
- 24m
- Merged PRs (30d)
- 1
Description
The Legal API business and filings endpoints do not validate that the the current account is authorized to access the data -- if I try to fetch that data for a business that is not affiliated to my account (and I am not staff), then I can still fetch the data.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.