inventory_catalog/product/getQty exposes stock levels
- Dominant language
- PHP
- Stars
- 357
- Forks
- 262
- PR merge metrics
- No merged PRs in 30d
Description
### Description (*)
Currently inventory_catalog/product/getQty exposes qty of configurables to the frontend. This isn't ideal.
Stock levels should be shown in accordance to only essential information
### Expected behavior (*)
Competitors shouldn't be able to scan your website and get our current inventory levels, this leads to malicious behaviour, like undercutting pricing until the stock is out, then raising pricing. This can be done without this figure, but having this figure give a much more accurate means to manipulate around it.
### Benefits
Currently this reduces the competitive edge that a store owner has. It can lead to manipulation and discounting patterns by competitors that would otherwise not have the capacity to see.
Contributor guide
Research direction
Start by tracing the inventory_catalog/product/getQty endpoint and the code that exposes configurable quantities to the frontend. Clarify which essential stock information must remain available, then verify that the endpoint no longer reveals current inventory levels while preserving the required frontend behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- api, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100