Back to WorkflowBench
✈️PlanePython47.1k starsProject Management & DevTools

One PR. 6 API security gaps in a 47k-star project management tool.

A single PR adding Pages CRUD to the public v1 API had basic unit tests but missed authorization bypass, rate limiting, and cross-workspace isolation. OrangePro surfaced all 6 from one pull request.

9
Requirements Extracted
6
Verified Gaps
22%
Coverage Before
89%
Coverage After
Trace Matrix

Requirement-to-Test Traceability

Every requirement extracted from the PR, mapped to existing tests and verified against the codebase. Click any row to see the search evidence.

Coverage Distribution

9
6 Gaps
2 Partial
1 Covered

Requirement Coverage

Before22%
After OrangePro89%
+67% coverage improvement
9 requirements traced|6 gaps|2 partial|1 covered
R1COVERED

GET /pages/ returns paginated list of project pages

PageListCreateAPIEndpoint
R2PARTIAL

POST /pages/ creates page with valid data and permissions

PageListCreateAPIEndpoint
R3GAP

API rejects requests without valid authentication

APIKeyAuthentication
R4GAP

API prevents cross-workspace page access

PageDetailAPIEndpoint
R5PARTIAL

DELETE /pages/:id requires appropriate permissions

PageDetailAPIEndpoint
R6GAP

API sanitizes input to prevent XSS in page content

PageAPISerializer
R7GAP

API enforces rate limiting on page creation

throttle_classes
R8GAP

API returns proper error responses for invalid page IDs

PageDetailAPIEndpoint
R9GAP

API key with read-only scope cannot create/update/delete pages

APIKeyAuthentication
Critical Findings

Top 3 Verified Gaps

These gaps were verified by searching the repository's test directories. Each finding includes the exact search query and result so you can reproduce it yourself.

1

No authorization bypass tests for cross-workspace isolation

search evidence

The v1 API exposes page data across workspaces. No test validates that workspace-level isolation is enforced — a user from workspace A should never access workspace B's pages via the API.

2

No input sanitization or XSS prevention tests

search evidence

Page title and description fields accept user input that gets rendered in the UI. No test in apiserver/tests/ validates that malicious input (script tags, SQL injection payloads) is properly sanitized.

3

No API key scope enforcement tests

search evidence

The API supports scoped API keys (read-only, read-write), but no test validates that a read-only key is rejected when attempting POST, PATCH, or DELETE operations on page endpoints.

Before vs. After

Coverage Comparison

RequirementBeforeAfter
GET /pages/ returns paginated list✓ Unit✓ Unit + Integration
POST /pages/ with valid permissions~ Partial✓ Unit + E2E
Unauthenticated request rejection✗ None✓ Integration
Cross-workspace page isolation✗ None✓ Integration + E2E
Unauthorized delete prevention~ Partial✓ Integration + E2E
XSS input sanitization✗ None✓ Unit + Integration
Rate limiting enforcement✗ None✓ Integration
Error responses for invalid IDs✗ None✓ Unit
API key scope enforcement✗ None✓ Integration + E2E
Verifiable Evidence

Don't take our word for it. Verify it yourself.

Every finding in this analysis is based on a public GitHub repository. Clone the repo, run the searches we documented, and see the same results. No black boxes.